Mini Shai-Hulud - .npm Cache File Drop Activity Burst

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

This rule detects an anomalous burst of file creation activity within the .npm/_npx/ cache directories. This behavior is often observed preceding the drop of malicious executables, such as 'bun.exe', as part of supply chain attacks targeting npm packages. The rule triggers when 10 or more files are created in these specific cache folders within a one-minute window on a single device.