@servicetitan/table @41.3.7

Summary

package.json declares scripts.preinstall = "node setup.mjs". setup.mjs is obfuscator-renamed (_0xXXXX identifiers, string-array indirection) and, on install, checks for a bun binary; if absent it downloads a Bun runtime release from github.com/oven-sh/bun/releases/download/bun-v1.3.13/, unzips it to a temp directory, chmods it executable, and uses execFileSync to invoke the fetched Bun binary against the sibling file math_init.js. math_init.js is a 727KB // @bun @bun-cjs bundle heavily obfuscated with a rotating string array (WV8StW shift routine) and a mixed numeric/char-code table (n7gIxM with 1000+ entries) that hides every identifier and literal. The remainder of the tarball is a plausible React table component matching the package's advertised purpose (homepage docs.st.dev/docs/frontend/table, repository servicetitan/anvil-uikit-contrib), i.e. legitimate-looking source is shipped alongside a hidden install-time payload. Fetching an alternate JavaScript runtime at install time in order to execute an obfuscated sibling bundle is the alternate-runtime dropper pattern: the payload is executed by a freshly-fetched runtime that Node-based tooling and scanners in the install environment do not observe. A React table component has no legitimate need for a second JS runtime or an obfuscated Bun-only bundle. The @servicetitan scope, homepage, and repository fields present the package as an internal ServiceTitan module, consistent with a scope takeover / dependency-confusion or hijack of an internal namespace.

Source: amazon-inspector (7d21aca35e498a14c8dc1c70aeedecdabf02937856ad4f6af423308aef3d8b9e)