Bun Runtime Execution Via Node.js Spawned Shell On Windows

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects a Windows shell process (e.g. cmd.exe, powershell.exe) spawned by Node.js with a command line referencing the Bun runtime, indicating a Node.js -> Shell -> Bun execution chain. This pattern is commonly observed in supply chain attacks where a malicious npm package abuses Node.js child_process APIs to launch a shell that invokes Bun as a second-stage JavaScript or TypeScript payload runner. Bun is attractive to attackers due to its native TypeScript support, fast startup, and broad system APIs, while being less scrutinized by EDR/AV solutions compared to Node.js itself.

2026-05-21 00:00:00

None

948e621f-296f-483e-b962-ab469054dbc2

attack.execution attack.t1059.007

Nextron Sigma feed only (private)