Bun (Product): news timeline & CVEs

Hackers Use Web3 and Blockchain C2 to Hide Supply Chain Attacks Targeting Cloud Credentials

Unit 42 says the ChainDrop npm worm uses Ethereum smart contracts as C2 to steal cloud and developer credentials.

Unit 42 reported that the ChainDrop npm worm, which infected more than 400 packages, uses an Ethereum smart contract as a dead-drop to learn its data-theft server. A single transaction rotated command-and-control from npm-cache[.]com to awqhnjewqjkl[.]icu without republishing the malware. The worm harvests cloud credentials, npm and GitHub tokens, SSH keys, Kubernetes and Vault tokens, Terraform state, and short-lived GitHub Actions OIDC tokens, and it persists through VS Code tasks and a Claude Code hook. A related North Korea-aligned campaign, PolinRider, used TRON, Aptos, and BNB Smart Chain to fetch encrypted payloads such as DEV#POPPER and OmniStealer.

Cyber Security News14:19 UTC · 8h agoMalware in the wild 3 sources

Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware

Attackers published a malicious tensorlake npm package that spreads a new Shai-Hulud supply-chain worm.

A threat actor published tensorlake npm version 0.5.144 on October 8, 2026, embedding a new self-replicating Shai-Hulud worm. Its preinstall hook runs obfuscated JavaScript that downloads the Bun runtime and steals environment variables, npm and GitHub tokens, cloud and SSH keys, Kubernetes and CI/CD secrets, and data from 14 cryptocurrency browser extensions. Stolen publishing credentials can spread the worm, and a dead-man’s switch can wipe hosts if an embedded GitHub token is revoked. The package was seeded via commits on Tensorlake’s GitHub; PyPI and Cargo builds were not compromised, and the npm package has over 100,000 lifetime installs.

GBHackersupdated 16:54 UTC · 5h agofirst 13:30 UTC · 9h agoMalware in the wild 6 sources

Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

Compromised tensorlake npm 0.5.144 delivered the Shai-Hulud worm to steal secrets and spread to other packages.

Socket and StepSecurity reported that tensorlake npm version 0.5.144 was compromised in the ChainDrop/Shai-Hulud campaign and later removed from the registry. A preinstall hook launched an obfuscated Bun loader that runs a self-propagating credential worm, Math_Symbol.js. The malware steals npm, GitHub, AWS, Vault, Kubernetes, SSH, cryptocurrency, and AI-assistant secrets, drops HackBrowserData, persists, and can execute remote code. It republishes infected packages, resolves C2 iseekaigogo.com through an Ethereum contract, stages data in public GitHub repositories, and may run a destructive PowerShell handler if a stolen GitHub token is revoked.

The Hacker Newsupdated 16:54 UTC · 5h agofirst 05:46 UTC · 16h agoMalware in the wild 6 sources2

Bun

Timeline3 articles

Appears with

Hackers Use Web3 and Blockchain C2 to Hide Supply Chain Attacks Targeting Cloud Credentials

Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware

Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm