T1195.002: Shai-Hulud npm preinstall bun run index.js Execution

Tim Peck@timpeck

•updated Sep 10, 2026•5•0•17

Detects the execution of the 'bun' JavaScript runtime invoking 'index.js' in the context of an npm package installation. This pattern is characteristic of the Shai-Hulud worm, which leverages the npm preinstall lifecycle hook to execute malicious code. The rule identifies suspicious process lineage where 'npm' spawns 'bun' for immediate payload execution, allowing for detection of the technique rather than specific artifacts.