🎯 Malicious preinstall script

The items that name it 2

• Shai-Hulud 2 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime | Blog | Endor Labs
  writeup2026-09-11

  Malicious pre-install script inserted into compromised package.json files that triggers the infection chain automatically upon installation

• Shai-Hulud Rises From the Dead after 111 days
  writeup2026-09-07

  preinstall script executing 'bun run index.js' to run a root-level index.js payload