Mini Shai-Hulud - Bun Network Conn then File Drop

Ibrahim Saud@tektrix

•updated Jun 19, 2026•1•0•6

Detects Bun beaconing to the checkmarx or kosche C2s, followed immediately by dropping a new .js or .mjs file. This behavior is indicative of a supply chain attack where a compromised Bun package might be attempting to establish C2 communication and then deploy malicious JavaScript files.