Node.js Downloading Bun Runtime from GitHub Releases

Ethan Andrews@eandrews

•updated May 29, 2026•2•0•16

Identifies Node.js processes downloading the Bun runtime from GitHub Releases. This behavior was observed in the vpmdhaj npm supply chain attack, where Gen-2 stagers silently downloaded Bun to execute bundled credential harvesting payloads without an immediate C2 payload drop.