Shai-Hulud npm preinstall bun run index.js Execution

Hrushikesh Badgujar@H3AD

•updated Sep 12, 2026•4•0•5

Detects the execution of the Bun JavaScript runtime invoking 'index.js' as part of an npm lifecycle event (such as preinstall). This pattern is commonly used in supply chain attacks to execute arbitrary code during the installation of malicious packages.