Why NPM Malware Keeps Reaching for Bun

Recent npm supply-chain campaigns, including Shai-Hulud 2.0 and later incidents, used malicious preinstall scripts to download the Bun runtime and execute credential-stealing payloads, exploiting npm’s ability to run package lifecycle code during installation rather than a vulnerability in Bun itself. Bun is a legitimate, fast, self-contained JavaScript runtime with broad adoption and safer dependency-script defaults than npm, but attackers favor it because its userland binary, alternative process name, built-in system functions, and limited compatibility with common Node monitoring hooks can help evade runtime-specific defenses. The campaigns targeted developer and CI credentials, cloud metadata and secret stores, and npm publishing tokens, sometimes propagating by compromising victims’ own packages or registering self-hosted runners. Recommended mitigations emphasize preventing malicious packages from executing through disabled lifecycle scripts with audited allowlists, dependency release-age cooldowns, lockfiles and reproducible installs, install-time blocking of known malicious versions, reduced dependency exposure, short-lived OIDC-based credentials, restricted CI access to metadata and secrets, and behavioral detection based on suspicious process lineage rather than Bun or any particular runtime.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.