Temporary Bun runtime path from package install

Daniel Jeremiah@daniyyell

•updated Jun 14, 2026•0•0•9

This rule finds Bun extracted to a temporary folder during npm install on a machine that does not normally use Bun. Temp paths hide binaries from casual inspection. Remove the package and scan the host. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.