keyv/cacheable Stage-2 Payload Artifacts On Disk
Detects creation of the stage-2 payload files distributed with the compromised keyv and cacheable packages. Math_Symbol.js is a ~728 KB Bun bundle shipped in the tarball and written to disk as math_init.js by the loader; bun-dl-* directories are used to stage the downloaded Bun runtime. These filenames are specific to the campaign and should be treated as high fidelity indicators.
Sigma
