Miasma Bun Runtime Execution in Temp Directory

Ethan Andrews@eandrews

•updated Jun 2, 2026•8•0•24

Detects suspicious execution of the Bun runtime executing a JavaScript payload from the /tmp directory, matching the Miasma stage-four execution pattern. This rule specifically looks for the Bun executable running a JavaScript file named 'p<random>.js' within the /tmp directory, which is characteristic of the Miasma credential stealer.