3 ms·
The malware uses a "prepare" hook to use bun to run the payload, an attack that ironically enough, bun is immune to. Enabling lifecycle scripts in dependencies
by chuckadams 5mo ago
The malware uses a "prepare" hook to use bun to run the payload, an attack that ironically enough, bun is immune to. Enabling lifecycle scripts in dependencies by default in 2026 is just plain malpractice.
- JamesSwift 5mo agoNote that bun is only immune to this because it isnt in the “top 500” that bypass this system by default. I was actually surprised (pleasantly, but still surprised) tanstack wasnt in that list already https://bun.com/docs/pm/lifecycle https://bun.com/docs/pm/lifecycle
- chuckadams 5mo agoGood to know. Though according to that page, bun still wouldn't have run it if it were on that list, since it came through a git dependency and not npm.