On November 24, 2025, researchers identified a wave of backdoored npm packages that had been downloading a second JavaScript runtime during install. Not a shell script, not a compiled binary from a CDN. A whole other interpreter. A file named setup_bun.js detected the host OS and architecture, downloaded or located the Bun runtime, and cached the binary in ~/.cache or the platform equivalent. Then it used Bun to run a roughly 10MB obfuscated bundle called bun_environment.js. Infected releases carried those two new files plus a modified package.json.
Datadog assessed that the worm installed Bun "likely to evade standard Node.js monitoring." That assessment is the interesting part of this incident, and it is also where the popular retelling goes wrong in two directions at once.
The vendors disagree on scope. Datadog counted 796 unique npm packages backdoored across 1,092 versions. Socket, in analysis updated through November 26, put it at over 500 packages across 700+ versions. Different collection windows, different counting rules, no reconciliation I can offer. Compromised releases appeared under the @zapier, @asyncapi, @postman, @posthog, and @ensdomains scopes. The last observed malicious publish was at 6 p.m. UTC on November 24, and Datadog saw exfiltration peak early that morning UTC, so the campaign was already running well before the day it surfaced. No source I read gives a start date. CISA had published an alert on an earlier wave on September 23, 2025, titled "Widespread Supply Chain Compromise Impacting npm Ecosystem." Whether the November actor is the same one, I did not verify.
