@servicetitan/tokens @12.9.7

Summary

The package's package.json declares preinstall: node setup.mjs , which fires automatically on npm install . setup.mjs is itself obfuscator.io-style obfuscated (identifiers such as _0x488df8 , mapping objects wrapping fs , https , and execFileSync calls) and, at install time, downloads the Bun runtime binary from https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/..., extracts it to a temporary directory, chmods it executable, and invokes it to execute a bundled math_init.js file. math_init.js is a 727KB single-line Bun-compiled artifact (header // @bun @bun-cjs ) with a rotating string-array obfuscator over roughly 1500 constant entries; it is not referenced from the package's declared main (dist/all.js) or from the library's documented design-tokens surface, and is reachable only through the Bun binary fetched by the preinstall script. The package's advertised purpose is design tokens and fonts, which has no need for a second JavaScript runtime or for an opaque, install-time-executed payload. This is the alternate-runtime-dropper pattern: a lifecycle hook fetches a non-Node runtime specifically to execute an obfuscated sibling file that Node-based scanners cannot inspect, yielding arbitrary code execution on the installer's machine on every install.

Source: amazon-inspector (73f232a2d0ac7ddef8c6fd83dc66cb32ccceef271e34e5b66ba357d68c9d2f9d)