Mini Shai-Hulud - Setup.mjs Execution to Checkmarx Audit C2

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

Links the execution of the initial setup.mjs payload to network traffic bound for audit.checkmarx.cx. This rule detects the execution of 'setup.mjs' via 'bun' followed by network communication to 'audit.checkmarx.cx' within a 10-minute window, indicating potential supply chain compromise activity.