@servicetitan/grid@0.0.66
Malicious code in @servicetitan/grid (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool TransferT1195.002 · Compromise Software Supply Chain
Analysis
The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and then executes a bundled 727KB heavily-obfuscated file (math_init.js) with it. The obfuscated payload uses a custom string-decoding scheme over a large dictionary array, concealing its behaviour from static analysis. A React grid component has no legitimate reason to download a runtime and run a large obfuscated payload at install time; this is a multi-stage dropper that executes attacker-controlled code during installation.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 03:06 PM
- analyzed
- Aug 4, 2026, 03:19 PM
- weekly installs
- 64
Related advisories
- @servicetitan/anvil-token@0.4.4
- @servicetitan/cp-mfe-dev@1.115.4
- @servicetitan/line-item-editor@1.5.4
- @onereach/v-event-calendar@0.1.24
- @onereach/or-content-builder-renderer@0.0.4
- @or-sdk/qna@3.4.4
- @onereach/orest-input-cli@1.18.3
- @onereach/or-browser-next@0.0.13
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.