Miasma GitHub Actions Dependabot Impersonation – CI Runner Bun Staging
Detects anomalous execution of the Bun runtime on CI/CD infrastructure, often associated with the 'Miasma/Mini Shai-Hulud' campaign. The rule monitors for unauthorized Bun process creation spawned by Node.js package management tools (likely via binding.gyp lifecycle hooks), execution using specific campaign-related command-line arguments, or network activity initiated by Bun on non-standard paths, which may indicate build-time compromise and subsequent C2 communication.
SentinelOne
