Bun JavaScript Runtime Executed Via Shell Spawned By Node.js On macOS

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects a macOS shell process (e.g. zsh, bash, sh) spawned by Node.js with a command line referencing the Bun runtime, indicating a Node.js -> Shell -> Bun execution chain. This pattern is commonly observed in supply chain attacks where a malicious npm package abuses Node.js to launch a shell that invokes Bun as a second-stage JavaScript or TypeScript payload runner. Bun is attractive to attackers due to its native TypeScript support, fast startup, and broad system APIs, while being less scrutinized by EDR/AV solutions compared to Node.js itself.

2026-05-26 00:00:00

None

32c86766-21d1-47cf-aec8-4b278153f912

attack.execution attack.t1059.007

Nextron Sigma feed only (private)