@servicetitan/eh-module-communication@0.2.5

Analysis

@servicetitan/eh-module-communication@0.2.5 is a trojanized clone of a legitimate ServiceTitan internal package. The preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun, extracts it, and executes a 727KB heavily-obfuscated payload file (math_init.js) through Bun. The obfuscated payload uses javascript-obfuscator-style encoding with a large constant array and base64-like string decoding. The package also depends on @servicetitan/log-service, a known malware package. The publisher account was compromised and used to trojanize this legitimate-scoped package.