Miasma Bun Runtime Staged from npm/node_modules for Credential Harvesting

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

Detects the malicious execution of the Bun JavaScript runtime associated with the Miasma supply chain attack. The rule identifies suspicious child processes spawned from development directories (like node_modules) that execute Bun to read sensitive configuration files, SSH keys, and cloud credentials typically targeted for exfiltration.