Tag

Bun

3 briefs RSS

Uncommon DNS Requests via Node.js or Bun Runtimes

Adversaries leverage compromised dependencies in Node.js or Bun development workflows to perform anomalous DNS lookups for command-and-control, staging, or exfiltration activities.

supply-chain command-and-control nodejs bun javascript

1r 1t 1w ago

critical advisory

Atomic Arch Campaign Leverages Orphaned AUR Packages for Linux Payload Deployment

3 rules 14 TTPs 6 IOCs

The Atomic Arch campaign compromises orphaned Arch User Repository (AUR) packages, modifying their PKGBUILDs to install malicious npm/Bun dependencies like 'atomic-lockfile,' which deploy a Linux payload with credential harvesting, eBPF-based stealth, anti-debugging, and data exfiltration capabilities, impacting approximately 1,500 packages.

Arch User Repository +2 supply-chain-attack npm bun linux malware credential-harvesting eBPF rootkit +1

3r 14t 6i Jun 14, 2026

low advisory

Uncommon DNS Requests via Bun or Node.js

2 rules 2 TTPs

Detection of uncommon DNS requests originating from Bun or Node.js processes, potentially indicating malicious code execution following a supply chain attack.

Elastic Endpoint supply-chain command-and-control dns nodejs bun

2r 2t May 21, 2026