The npm Worm That Brought Its Own Interpreter

On November 24, 2025, a wave of backdoored npm packages was identified that downloaded a second JavaScript runtime during installation. The malicious runtime, named Bun, was hidden within files called setup_bun.js and bun_environment.js, which were cached on the host system. The compromised packages appeared under various scopes, including @zapier, @asyncapi, @postman, @posthog, and @ensdomains.

The worm installed Bun likely to evade standard Node.js monitoring, and exfiltration of stolen data peaked early on the same day the campaign was first observed. No clear start date was provided, but CISA had published an alert on an earlier wave on September 23, 2025. The attacker injected a preinstall hook that invoked setup_bun.js during the npm install process.

The payload was designed to run quietly, suppressing all stdout and stderr, and used TruffleHog to actively hunt for secrets on the host. The stolen data was sent to repositories created in the victim's own GitHub account, with names matching a specific pattern and a fixed description string. The worm also used stolen npm tokens to fetch and inject malicious files into the maintainer's packages, bumping the patch version before republishing.

The payload executed during the preinstall phase, before tests or security checks, making it difficult for many teams to detect the malicious activity. CISA recommends setting ignore-scripts=true in .npmrc to prevent potentially malicious scripts from executing during npm install, but few teams have adopted this control due to compatibility costs.