Note: This report is updated by a verification record
Suspicious preinstall script and bash persistence attempts indicate potential malware.
Confirmed malicious package as part of coordinated supply chain attack targeting npm ecosystem
Note: This report is updated by a verification record
The package exhibits multiple suspicious behaviors. The package.json includes a preinstall script that executes node setup_bun.js, which is flagged as suspicious. Both bun_environment.js and setup_bun.js trigger the bash_persist_persistent YARA rule, indicating potential attempts to modify bash startup files for persistence. The combination of these factors suggests malicious intent.
