Shai-Hulud 2.0 - Large bun_environment.js File Creation

Mehulkumar Savajani@Msavajani

•updated Dec 3, 2025•17•0•261

Detects the creation of an unusually large 'bun_environment.js' file (>= 9MB). This is a characteristic of the Shai-Hulud 2.0 worm which uses extreme obfuscation, resulting in a massive payload file.