Mini Shai-Hulud - Bun Executing Multiple Known Payloads

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•3

Detects an environment where 'bun' is executing both the primary ('setup.mjs') and secondary ('execution.js' or 'bw_setup.js') payloads within an hour, indicating a potential supply chain attack.