Mini Shai-Hulud - Npm.cmd Spawning Bun Directly

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•6

Detects npm.cmd or npx.cmd directly spawning the bun.exe payload runtime, which could indicate a supply chain attack or malicious package execution.