Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Downloads the Bun JavaScript runtime v1.3.13 directly from its official GitHub release page. Launches the second-stage payload via Bun.
setup.mjs... Launches the second-stage payload via Bun... The Math_Symbol.js file is a heavily obfuscated file executed by Bun
Native extension import trigger — Malicious code is embedded directly inside compiled .abi3.so extensions. The Python source appears clean, but the extension executes _index.js the moment Python loads the module via dlopen()
That '.bun' section is the actor’s payload container. This holds malicious JavaScriptCore bytecode for 'app.js'. When the assembled file runs, the Bun interpreter engine executes that embedded bytecode.
The malicious packages use preinstall hooks to download the Bun JavaScript runtime and execute an obfuscated payload.
At install time, the packages fetch a signed Bun runtime release from GitHub, execute an obfuscated JavaScript stealer under it, and delete the runtime.
.pth startup-hook pattern — A malicious wheel bundles a *-setup.pth file alongside _index.js. The hook fires during Python startup, silently downloads the Bun JavaScript runtime, and executes the obfuscated stealer payload.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The Bun JavaScript runtime is used by the malicious loader to execute the staged Shai-Hulud payload, downloading Bun from GitHub releases if it is not already present on the victim system.
A legitimate JavaScript runtime abused by Shai-Hulud to execute later-stage payloads in the JavaScript/npm infection path.
A legitimate JavaScript runtime abused by the malware as an execution and evasion component; the payload installs Bun and uses it to run malicious scripts and decrypt secondary payloads.
Used by the malicious package as an evasion-oriented execution runtime to launch the Shai-Hulud payload during npm package installation. The loader downloads Bun v1.3.13, executes the payload, and removes artifacts to reduce forensic visibility.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.