@servicetitan/anvil2-ext-mwv@0.0.9

Analysis

The package @servicetitan/anvil2-ext-mwv@0.0.9 executes a preinstall hook (setup.mjs) that downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and then runs a 727KB Bun-compiled binary blob (math_init.js) with it. The compiled binary is opaque and unreadable — it is the actual payload. The package also depends on @servicetitan/anvil2, a known malicious package. The preinstall hook runs automatically on npm install, giving the payload full access to the installer's environment.