Miasma Malware: Bun Runtime Used to Execute Hidden Payloads

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•4

Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.