npm Preinstall Hook Followed by Staged Bun Execution
Temporal correlation of the two highest-confidence stages of the keyv/cacheable compromise: a setup.mjs preinstall hook executing, followed within 15 minutes on the same host by a Bun runtime executing from a staging or node_modules path. Either alone is tunable noise on a developer estate; the pair is the campaign. Use this as the alerting rule and keep the base rules at correlation-input severity.
Sigma
