Miasma Phantom Gyp: Bun Runtime Spawned from npm/node with binding.gyp AES-GCM Loader

Ibrahim Saud@tektrix

•updated Jun 27, 2026•2•0•1

Detects execution patterns associated with the Miasma/Mini Shai-Hulud multi-layer obfuscated npm payload. This includes monitoring for bun runtime spawning from Node/NPM contexts, execution of bun with specific patterns from /tmp, downloading of specific bun versions from GitHub, and execution of suspicious index.js scripts within .claude directories.