Note: This report is updated by a verification record
Multiple YARA matches and suspicious preinstall script indicate malicious behavior. Shell persistence attempts and arbitrary code execution are concerning.
The package is marked as malware by OSV: MAL-2025-190913 with source: amazon-inspector
Note: This report is updated by a verification record
The package exhibits multiple suspicious behaviors. The bash_persist_persistent YARA rule matched in setup_bun.js and bun_environment.js indicates potential attempts to modify shell startup files for persistence. Additionally, the npm_preinstall_command YARA rule matched in package.json, coupled with the LLM's assessment of a suspicious preinstall script executing node setup_bun.js, raises concerns about malicious code execution during installation. The preinstall script running setup_bun.js is a strong indicator, especially when combined with the shell persistence attempts.
