Miasma Bun Runtime Staged from npm Install to Execute Credential Stealer

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•3

This rule monitors for the execution of the 'bun.exe' process specifically when it originates from a Node.js-related context (such as npm, node-gyp, or binding.gyp execution) or exhibits suspicious behaviors like executing payloads from /tmp directories. This pattern is often associated with supply chain attacks or malicious package execution within JavaScript development environments.