Suspicious Bun Runtime Execution from Temporary Location Description

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

Detects Bun runtime execution from temporary or user-writable directories such as /tmp/ or Windows Temp folders. Threat actors increasingly leverage Bun as an alternative JavaScript runtime to execute payloads directly from temporary locations and evade traditional application controls.