@servicetitan/mfe-quick-actions@0.5.53

Analysis

The package ships a preinstall hook (setup.mjs) that downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and executes a 727KB heavily-obfuscated script (math_init.js) through it at install time. The obfuscation uses javascript-obfuscator patterns (dictionary arrays, base64 decoding, XOR-encoded constants) to hide the payload's behaviour. The dist/ directory contains legitimate-looking React/TypeScript microfrontend code as camouflage. The package depends on known-malware @servicetitan/* packages. The preinstall hook runs automatically on npm install, downloading a binary runtime and executing obfuscated code with no user interaction.