@servicetitan/carto-charts-core@0.0.6

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a 727KB heavily-obfuscated script, math_init.js, during npm install. The script is obfuscated with a javascript-obfuscator string-array/decoder pattern that hides its behavior from inspection. The package's declared purpose is an ECharts chart-theming library, and its shipped dist/ code is a normal chart library — the obfuscated install-time payload is unrelated to that purpose and runs automatically on every install. The payload's network and data-access behavior is concealed by the obfuscation.