@servicetitan/carto-charts-rn@0.0.6

Analysis

The package @servicetitan/carto-charts-rn@0.0.6 is a trojanized React Native chart library. On install, the preinstall hook (setup.mjs) checks if the Bun JavaScript runtime is available; if not, it downloads Bun from github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/ (platform-specific zip), extracts it, and executes a 727KB heavily obfuscated file (math_init.js) through the downloaded Bun runtime. The math_init.js file uses javascript-obfuscator patterns (thousands of _0x-prefixed identifiers, a custom base64 decoder, and a large constant array) and contains eval, Function constructor, and child_process calls. The package also depends on @servicetitan/carto-charts-core@0.0.1, which is a known malicious dependency. The package has no repository URL and the publisher has no verifiable identity.