registry / @servicetitan/cp-mfe / 1.115.4

@servicetitan/cp-mfe@1.115.4

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Installing the package invokes an obfuscated payload without user action. The payload can retrieve and evaluate remote code and harvest GitHub credentials for transmission.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm preinstall

Impact

Remote code execution and GitHub credential exfiltration during installation.

Mechanism

download-or-run Bun, then execute obfuscated credential-harvesting payload

Attack narrative

npm preinstall runs setup.mjs, which executes math_init.js using an installed Bun or downloads a Bun binary and executes it. The concealed math_init.js includes remote response evaluation and logic that locates GitHub token material and sends it via request handlers, constituting install-time credential theft and remote code execution.

Rationale

This is concrete unconsented install-time execution, not an application-aligned dependency helper. The obfuscated payload's credential collection, exfiltration flow, and remote eval establish malicious intent.

Evidence

package.jsonsetup.mjsmath_init.js

Network endpoints1

github.com/oven-sh/bun/releases/download/bun-v1.3.13/

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-11844

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @servicetitan/cp-mfe (npm)

Details

npm/@servicetitan/cp-mfe is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: Here We Go Again" wave) — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed version(s) were trojanized and republished by the worm after it reached an npm publish token belonging to a maintainer in this namespace; the payload enumerates every package a stolen token controls and republishes each with the same hook, so many packages under this scope were poisoned in the same short window. Every poisoned release adds a preinstall hook (`"preinstall": "node setup.mjs"`) that runs on a bare `npm install`, before any project code. setup.mjs downloads a standalone Bun runtime and runs a byte-identical, heavily obfuscated ~728 KB second-stage credential stealer (shipped as Math_Symbol.js / math_init.js). It harvests GitHub, npm, AWS, GCP, Azure, HashiCorp Vault and Kubernetes credentials plus generic secrets and private keys (TruffleHog-style sweep), reads CI/CD secrets and identifies build runners, then republishes further packages the stolen token can reach. Rather than a fixed command-and-control host, it exfiltrates stolen findings to attacker-created GitHub repositories (descriptions reading "Shai-Hulud: Here We Go Again") and over DNS. Treat any environment that installed an affected version (with install scripts enabled) as compromised: rotate and revoke all reachable credentials (npm and GitHub tokens, cloud keys, Vault/Kubernetes secrets, and CI org/repo secrets). Part of the August 2026 npm worm that poisoned 400+ packages across many organizations. --- ## Source: amazon-inspector (0a202f5aba5c626eb1bbdf143016659afe79f1b8c075df5655621eec5ceb2142) Version 1.115.5 of @servicetitan/cp-mfe ships a preinstall lifecycle hook (`scripts.preinstall: node setup.mjs`) that, on `npm install`, downloads the Bun runtime from github.com/oven-sh/bun/releases/download/bun-v1.3.13 to a temp directory, chmods it executable, and invokes it via `execFileSync` against a sibling file `math_init.js`. `math_init.js` is a 727KB single-file Bun-CJS module (header `// @bun @bun-cjs`) heavily obfuscated with hex-named identifiers, a large numeric/string lookup table, and an array-rotation decoder (obfuscator.io style); it is not listed in package.json `files` (declared as `["dist", "src"]`) but is shipped at the tarball root. The `setup.mjs` dropper itself is also obfuscated with hex-mangled identifiers and per-function property-name maps, and includes musl/Alpine detection (`ldd --version`, `/etc/os-release`) to select the appropriate Bun variant for Linux CI and container hosts. The package's advertised purpose is a browser React micro-frontend (MobX + react-router), which has no legitimate need for a second language runtime at install time or for an obfuscated Bun-compiled binary blob. The alternate-runtime dropper pattern intentionally bypasses tooling that only inspects Node-resolved code, and the obfuscated payload executes with the privileges of the installing user on any developer machine or CI host that runs `npm install @servicetitan/cp-mfe@1.115.5`. ## Source: ghsa-malware (cc6f5322a510f9c20357f78d4e62a8e2e116dfe30892f365ad9c50a45a510558) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs setup.mjs during preinstall.
setup.mjs executes math_init.js with Bun, downloading and executing Bun if absent.
math_init.js is a 727KB obfuscated installer payload.
math_init.js fetches response text and evals it.
math_init.js enumerates GitHub token sources and sends token-bearing data through request logic.

Evidence against

src/ and dist/ are ordinary micro-frontend UI code.
The visible Bun download URL is github.com/oven-sh, but it executes the concealed local payload.

Behavioral surface

Source

ChildProcessEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 10 file(s), 737 KB of source, external domains: github.com

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

math_init.jsView file

1// @bun @bun-cjs L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

setup.mjsView file

1Manifest entrypoint (scripts.preinstall) carries capability families absent from dist/build output: execution+network L1: #!/usr/bin/env node L2: import { execFileSync } from "child_process"; L3: import _0x488df8 from "fs"; L4: import _0x52943e from "https"; L5: import _0x24db8d from "os"; ... L50: function ra() { L51: const _0x51cd53 = process.platform + "-" + process.arch; L52: const _0x3ab5c4 = PM[_0x51cd53]; ... L218: } else if (_0xc0d7d2 === 8) { L219: _0x27994e = _0x548d91.inflateRawSync(_0x5975df); L220: } else {

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

setup.mjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @hubsync/web-sdk-react@6.3.26 matchedPath = setup.mjs matchedIdentity = npm:QGh1YnN5bmMvd2ViLXNkay1yZWFjdA:6.3.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 04ba21a16d3a5a3a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = pob-test-typescript-package-in-monorepo@4.2.10 matchedPath = setup.mjs matchedIdentity = npm:[redacted]:4.2.10 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

setup.mjsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

math_init.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

setup.mjsView file

Findings

4 High2 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighEntrypoint Build Divergencesetup.mjs

HighKnown Malware Source Similaritysetup.mjs

HighKnown Malware Source Fingerprint Signaturesetup.mjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalmath_init.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License