@servicetitan/startup-mfe-compat@0.5.3

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and then executes a bundled 727KB script (math_init.js) under that runtime at install time. math_init.js is obfuscated with a custom string-encoding scheme, so its behaviour cannot be audited; it runs arbitrary code on the installer's machine during npm install. The package's declared purpose (a micro-frontend dependency-compatibility checker) does not require downloading a runtime or executing a large obfuscated script at install. No network C2 endpoint could be identified because the payload's strings are encoded.