npm Preinstall Adds Bun Loader Files (setup_bun.js / bun_environment.js)

Daniel Jeremiah@daniyyell

•updated Feb 28, 2026•0•17

Detects process creation events where the command line contains references to 'setup_bun.js' or 'bun_environment.js' along with 'preinstall'. This combination is indicative of the SANDWORM_MODE Shai-Hulud-style worm, which leverages npm preinstall scripts to execute malicious JavaScript files.