@servicetitan/react-ioc @38.1.7

Summary

package.json declares preinstall: node setup.mjs . On npm install , setup.mjs downloads the Bun runtime from https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/ into a temporary directory, marks it executable, and invokes it against the sibling file math_init.js (approximately 727 KB, heavily obfuscated with string-array rotation, a large opcode lookup table, mangled identifiers, and character-code reconstruction). If bun is already on PATH, that binary is used directly. The obfuscated payload is not referenced by the library's declared main (dist/index.js), which only re-exports Inversify helpers ( rootContainer , Provider , Store , and related). Executing an opaque 727 KB blob under a freshly-fetched alternate runtime at install time bypasses Node-based static analysis and grants arbitrary code execution on every installer's host. The behavior is unrelated to the advertised React IoC / Inversify wrapper functionality and is consistent with a maintainer-account compromise or malicious republish of a previously legitimate package.

Source: amazon-inspector (64a18b447558d40630d9e34379b93d893059c8bef75a9a25d1b85eb7e1f47a42)