Comment Comment by roskoalexey Some more details:1. Malware uses a "preinstall" NPM script, which is triggered upon you running `npm install`.2. Malware installs `bun`.3. Then it installs and starts `trufflehog` (a tool for scanning code for secrets, API keys, passwords, etc.). parent roskoalexey 11 months ago
1. Malware uses a "preinstall" NPM script, which is triggered upon you running `npm install`.
2. Malware installs `bun`.
3. Then it installs and starts `trufflehog` (a tool for scanning code for secrets, API keys, passwords, etc.).