@servicetitan/examples@1.2.8

Analysis

The package @servicetitan/examples@1.2.8 is a trojanized version of a legitimate ServiceTitan package, published by the same compromised account that published @servicetitan/marketing-integration-widgets@1.0.44. The preinstall hook downloads the Bun JavaScript runtime and executes a heavily-obfuscated payload. At runtime the package was confirmed to fetch remote content and eval-execute it (a remote-code-execution dropper), and to make DNS queries to a sinkholed domain. The obfuscated payload in the bundled dist/bundle/light/index.js reaches out to attacker-controlled infrastructure for second-stage payload delivery.