Mini Shai-Hulud - Node Dropping Bun and Immediately Executing

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

This rule detects a suspicious activity chain where a Node.js process drops the 'bun.exe' binary to disk, and then the system executes 'bun.exe' within a 5-minute window. This behavior is indicative of potential supply chain attacks or malicious code execution, where Node.js might be used to deploy and run an unauthorized executable.