Mini Shai-Hulud - Setup.mjs Spawning Child Processes

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

Detects the bun setup.mjs execution acting as a parent, spawning further suspicious processes like curl or bash. This behavior is indicative of potential supply chain compromise where a legitimate-looking setup script executes malicious commands.