Major NPM Supply Chain Attack: Over 1,000 Packages Infected via Fake Bun Runtime
By
mrdosija
Summary
A major cybersecurity incident occurred where over 1,000 NPM packages and 27,000+ GitHub repositories were infected within hours via a fake Bun runtime. The attacker used the `preinstall` script to download and execute malicious payloads that steal sensitive information from compromised machines. This attack follows the same method as a previous incident, indicating a pattern of supply chain attacks targeting the JavaScript/Node.js ecosystem.
Key quotes
· 3 pulledOver 1,000 NPM packages were infected using the same method as the previous attack, infecting with a fake Bun runtime.
The attacker leveraged the `preinstall` script to download and execute a malicious payload, stealing sensitive information from the compromised machines.
Over 1K NPM Packages and 27K+ Github Repos infected via Fake Bun Runtime Within Hours — HelixGuard
You might also wanna read
September 2025 NPM supply-chain attack compromises popular JavaScript packages
In September 2025, a coordinated software supply-chain attack targeted multiple popular NPM packages in the JavaScript ecosystem. The attack
Microsoft uncovers supply chain attack: Compromised @antv npm packages steal CI/CD credentials via Mini Shai-Hulud malware
Microsoft has identified an active supply chain attack targeting the @antv npm package ecosystem. A threat actor compromised an @antv mainta
176 malicious npm packages used dependency confusion to target internal dependencies and steal credentials
Sonatype researchers uncovered a campaign involving 176 malicious npm packages using a dependency confusion attack strategy. Attackers publi
sonatype.com·2d ago
Microsoft uncovers npm supply chain attack stealing cloud and CI/CD credentials via typosquatted packages
Microsoft identified an active supply chain attack (Mini Shai-Hulud campaign) targeting the npm package ecosystem. On May 28, 2026, a threat
Attacker publishes 14 malicious npm packages impersonating OpenSearch and Elasticsearch libraries
A single npm user published 14 malicious packages over four hours, impersonating popular OpenSearch, Elasticsearch, DevOps, and environment-
briefly.co·2d ago
Microsoft detects 14 malicious npm packages impersonating OpenSearch and Elasticsearch libraries
A threat actor using the alias vpmdhaj published 14 malicious npm packages within four hours, impersonating legitimate OpenSearch, Elasticse
theregister.com·1d ago