Mini Shai-Hulud - Curl/Wget Executing Downloaded Payload

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

Looks for curl or wget downloading a payload followed by node or bun immediately executing a .js or .mjs file. This pattern is indicative of supply chain attacks, particularly those targeting JavaScript ecosystems like npm.