Post

mbt@1.2.48 and @cap-js/sqlite@2.2.2 are malicious. preinstall hook → fetches Bun runtime → executes obfuscated payload → exfils GitHub/npm/AWS/Azure/GCP/k8s secrets → writes to attacker-controlled GitHub repos with description "A Mini Shai-Hulud Has Appeared" we pushed rules for customers