T1027

Obfuscated Files or Information

discovered 2025-09-16

_runtime.bin uses // @bun @bun-cjs header with MxGPr9 string-array rotation obfuscation and fromCodePoint decoder — the same javascript-obfuscator pattern documented in Mini Shai-Hulud router_init.js.

View on MITRE ATT&CK

Seen in packages

Campaigns