@servicetitan/anvil-token@0.4.4
Malicious code in @servicetitan/anvil-token (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool TransferT1027 · Obfuscated Files or Information
Analysis
The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from the official oven-sh/bun GitHub release and then executes a bundled 727KB file (math_init.js) that is heavily obfuscated with a custom string-decoder and large numeric constant array, making its behavior unreadable. A design-token library has no legitimate reason to download a runtime and run an opaque payload at install time. The executed payload's network/file behavior could not be determined from the obfuscated source.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 03:23 PM
- analyzed
- Aug 4, 2026, 03:33 PM
Related advisories
- @servicetitan/cp-mfe-dev@1.115.4
- @servicetitan/grid@0.0.66
- @servicetitan/line-item-editor@1.5.4
- @or-sdk/tags@1.1.7
- @or-sdk/transcripts@1.2.7
- @or-sdk/identifiers@0.27.8
- @onereach/v-event-calendar@0.1.24
- @or-sdk/bot-templates@2.2.7
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.