@servicetitan/html-sketchapp@4.2.11

Analysis

A trojanized fork of the html-sketchapp package executes an obfuscated payload at install time. The package adds a preinstall hook (node setup.mjs) that downloads the Bun JavaScript runtime and runs a 727KB heavily-obfuscated bundle (math_init.js) with it. The bundle uses a custom base64 alphabet and string-table obfuscation, hiding all URLs and strings from static inspection. The package's legitimate HTML-to-Sketch conversion code is present in plaintext, but the install hook runs the opaque obfuscated payload regardless. Installing this package executes unknown remote-downloaded code during npm install.