Bun
Named by 76 kept items in this workspace.
43 items name it under classification.technologies, 21 under tools and 12 under affected products.
The items that name it 76
Portable JavaScript runtime, renamed by the attacker, used to launch the staged loader.
executables built with bun build --compile embed the runtime and stay vulnerable until rebuilt
updated
fixed in 1.4.4
also acquired; popular with malicious actors
JavaScript/TypeScript runtime dropped onto infected hosts by setup.mjs and used to execute the obfuscated Shai-Hulud payload (Math_Symbol.js).
JavaScript runtime/package manager compared on install speed and size
oven-sh/setup-bun; installed by the malicious action and used to run bun run $GITHUB_ACTION_PATH/index.js
Alternative package manager used by the upgrade endpoint with the same injectable install command
JavaScript runtime dynamically installed by the malware during package installation to execute large obfuscated payloads with improved stealth, evading defenses tuned to Node.js
Alternative JavaScript runner (to Node.js), downloaded and used by the malicious Keyv package to execute a second obfuscated JavaScript payload
Legitimate JavaScript runtime executable downloaded by the attacker payload from GitHub release infrastructure and run from a temporary directory (/tmp/trinnyyyy-*/bun) to perform credential harvesting actions
package manager/runtime used to install, build and test numasec ('bun add -g numasec', 'bun install', 'bun run build', 'bun test')
Underlying runtime dependency credited by the project
package manager checked for registry configuration
Runtime the loader uses (official release bun-v1.3.13 downloaded from github.com/oven-sh/bun) to run the second stage
package manager; supports minimum release age setting
JavaScript runtime abused by attackers to stage and execute malware payloads
supported ecosystem for missing lockfile detection and remediation guidance
JavaScript runtime downloaded and used to execute the obfuscated _index.js stealer payload
Added cooldown/minimum release age feature
JavaScript/TypeScript runtime (v1.3.13) abused by the malware loader to execute the obfuscated payload cross-platform, chosen because it's less likely to be flagged by endpoint security tools and can execute .bin-extension JS files.
JavaScript runtime abused via preinstall scripts to invoke an obfuscated_index.js loader as Miasma's execution mechanism
JavaScript runtime used in the malicious GitHub Actions workflow to execute the attacker's publishing script (_index.js)
JavaScript runtime used to execute the malicious index.js payload via a preinstall script
JavaScript runtime abused by the malware to execute obfuscated payloads (e.g., execution.js, tanstack_runner.js) during package install/lifecycle scripts
JavaScript runtime downloaded and executed by the malicious preinstall bootstrapper (setup.mjs); version bun-v1.3.13 pulled from github.com/oven-sh/bun/releases
Legitimate JavaScript runtime; abused by attackers who downloaded an unverified, platform-specific Bun binary/ZIP from GitHub Releases without integrity checks and used it to execute the malicious payload.
JavaScript runtime/package manager; minimumReleaseAge cooldown setting in bunfig.toml (added in 1.3).
Alternative install method; may block postinstall script
In every workspace you can read 93
Security
AI
All technologies in this workspace.