🧰 Bun JavaScript runtime

The items that name it 4

• Tensorlake npm Package Compromised to Spread Shai-Hulud Worm
  articleas tools2026-10-08It is written here as Bun JavaScript runtime: downloaded by the malware to run the main payload lib/Math_Symbol.js.
• Why NPM Malware Keeps Reaching for Bun | Supply Chain Security | Blog | Endor Labs
  articleas affected products2026-08-12It is written here as Bun JavaScript runtime (used as malware execution vehicle; also has CVE-2026-24910 trusted-dependency spoofing flaw).

  used as malware execution vehicle; also has CVE-2026-24910 trusted-dependency spoofing flaw

• VSCode Lifecycle Script Malware
  writeupas affected products2026-05-16
• actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials - StepSecurity
  advisoryas tools

  Downloaded by the attacker's malicious payload to the runner (to /home/runner/.bun/bin/bun) to execute the credential-harvesting code