@servicetitan/mfe-quick-actions@0.5.52

Analysis

The @servicetitan npm organization was compromised. @servicetitan/mfe-quick-actions@0.5.52 was published with a preinstall hook (setup.mjs) that downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and executes a 727KB obfuscated payload (math_init.js) through it. The payload is heavily obfuscated with javascript-obfuscator-style encoding. The package also contains a bundled bundle (dist/bundle/light/index.js) that fetches remote content and executes it via eval/Function constructor. The legitimate ServiceTitan source code is bundled alongside the malicious preinstall hook and payload.