Miasma npm ROT/AES-GCM Obfuscated Loader - Phantom Gyp and Bun Staging

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects known malicious file hashes associated with Miasma/Mini Shai-Hulud malware, as well as suspicious npm-lifecycle behaviors including binding.gyp shell execution, runtime staging of the Bun engine, and suspicious Bun-related downloads from GitHub.