Mini Shai-Hulud - Deeply Nested Bun Execution from Cache

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

This rule detects the anomalous execution of 'bun.exe' when it originates from deeply nested temporary npm cache paths. This pattern is indicative of potential software supply chain attacks where malicious code might be injected into development dependencies.