Anomalous Bun Runtime Download

Ethan Andrews@eandrews

•updated Jun 8, 2026•2•0•7

Detects the anomalous download or extraction of the Bun JavaScript runtime. The Miasma worm downloads Bun during npm/node-gyp installation phases to execute its payloads outside of standard Node.js monitoring, evading detection.