@servicetitan/micro-frontend@0.0.8

Analysis

The package @servicetitan/micro-frontend@0.0.8 contains a preinstall hook (setup.mjs) that downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and executes a heavily obfuscated 727KB payload file (math_init.js) through it. The setup.mjs detects the platform and architecture, downloads the appropriate Bun binary, extracts it, and runs the bundled obfuscated script. This is a remote-code-execution-at-install pattern: the attacker ships an obfuscated payload and bootstraps a runtime to execute it. The same payload pattern appears in other packages from the same compromised publisher. The package also depends on @servicetitan/error-boundary, which is known malware.