🧰 Bun runtime

The items that name it 4

• Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It
  writeup2026-10-08

  Downloaded by the malicious preinstall script (setup.mjs) and used to run an obfuscated 856 KB payload file

• Evolution of Web3 in Cloud Supply Chain Attacks
  article2026-10-07

  Custom Bun runtime downloaded by the ChainDrop preinstall hook to launch an obfuscated credential harvester.

• Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks
  writeup2026-08-04It is written here as Bun runtime (version 1.3.13).

  Runtime used to execute the second-stage payload math_init.js; loader fetches Bun from GitHub if absent

• Nx Console VS Code Extension Compromised
  writeup2026-06-02

  Legitimate JavaScript runtime installed as a side effect of the dropper's package.json dependency, providing execution environment for the payload