ChainDrop/Shai-Hulud npm Preinstall Dropper - Bun Runtime Spawned by Node.js

Ethan Andrews@eandrews

•updated Aug 4, 2026•41•0•51

Detects the execution of the Bun JavaScript runtime by npm or node.js during lifecycle tasks (preinstall, postinstall, etc.). This behavior is highly indicative of the ChainDrop/Shai-Hulud supply chain worm, which uses npm lifecycle scripts to download and execute a second-stage payload using the Bun runtime.