@servicetitan/anvil2-ext-charts@0.2.8

Analysis

Package @servicetitan/anvil2-ext-charts@0.2.8 is a trojanized chart-theme library. It contains a preinstall hook (setup.mjs) that downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and executes a 727KB heavily-obfuscated file (math_init.js) with it. The obfuscated payload uses javascript-obfuscator's dictionary-array pattern with a custom decoder to hide its behavior. The package also depends on @servicetitan/hammer-token, a known-malware package. A chart-theme library has no legitimate reason to download a runtime and execute obfuscated code at install time.