@servicetitan/cp-mfe-dev@1.115.4
Malicious code in @servicetitan/cp-mfe-dev (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool Transfer
Analysis
The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and then executes a bundled 727KB file (math_init.js) that is heavily obfuscated with a custom string-decoder, so its actual behaviour cannot be determined from the source. The install-time execution of an undocumented, obfuscated payload is the observable risk; no network destination or exfil target was observed in the readable portion of the package.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 03:07 PM
- analyzed
- Aug 4, 2026, 03:21 PM
- weekly installs
- 263
Related advisories
- @servicetitan/anvil-token@0.4.4
- @servicetitan/grid@0.0.66
- @servicetitan/line-item-editor@1.5.4
- @or-sdk/api-tokens-lambda@1.4.4
- @onereach/v-event-calendar@0.1.24
- @onereach/or-content-builder-renderer@0.0.4
- @or-sdk/qna@3.4.4
- @onereach/orest-input-cli@1.18.3
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.