Tool
Bun
- First Reported
- Apr 30, 2026
- Latest Reported
- Oct 7, 2026
Reported Context (4)
- The worm executes a preinstall script hook that downloads a custom Bun runtime to launch an obfuscated credential harvester. Supply-Chain Malware Uses Blockchain Transactions for Resilient Command and Control
- During install, the compromised packages execute a script that downloads the Bun runtime from GitHub (codeload.github.com), then runs a tanstack_runner.js payload via bun run tanstack_runner.js. Worm-Like npm Supply-Chain Attack Compromises More Than 50 Packages
- During install, [email protected] executes a setup.mjs script via preinstall hook, that downloads the Bun runtime from GitHub, then runs a router_runtime.js payload which executes gh auth token to harvest GitHub Compromised Intercom npm Package Steals GitHub Credentials Using Shai-Hulud-Style Attack
- start.py, which downloads and executes Bun, a JavaScript runtime, from GitHub Compromised Lightning PyPI Releases Steal Credentials and Spread Through GitHub and npm
Malware (2)
Threat Actors (5)
MITRE ATT&CK (8)
Products (16)
Tools (1)
Industries (3)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.