@servicetitan/line-item-editor@1.5.4

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun runtime from the official oven-sh GitHub release and then executes a bundled 727KB heavily-obfuscated script (math_init.js) at install time. The install-time payload is obfuscated with a dictionary-array/string-encoding scheme, so its behavior is not readable. A React UI component library executing a large obfuscated script downloaded-and-run at install is anomalous and unverifiable; the payload's network and file activity could not be confirmed benign.