@servicetitan/titan-chat-ui@7.1.7

Analysis

The npm account for @servicetitan/titan-chat-ui was compromised. Version 7.1.7 contains a preinstall hook (setup.mjs) that downloads the Bun JavaScript runtime from the official Bun GitHub releases and executes a heavily obfuscated 727KB payload file (math_init.js). The package also depends on @servicetitan/titan-chat-ui-common, which is a known-malicious package from the same compromised account. The obfuscated payload is the attack vector; the Bun bootstrap is the delivery mechanism. No network exfiltration endpoints were observed in the bootstrap code, but the obfuscated payload's behaviour cannot be determined from static analysis alone.