T1027
Obfuscated Files or Information
discovered 2025-09-16_runtime.bin uses // @bun @bun-cjs header with MxGPr9 string-array rotation obfuscation and fromCodePoint decoder — the same javascript-obfuscator pattern documented in Mini Shai-Hulud router_init.js.
View on MITRE ATT&CKSeen in packages
- npm @ctrl/tinycoloruses
- npm @zapier/zapier-sdkuses
- npm @asyncapi/specsuses
- npm @quick-start-soft/quick-markdown-printuses
- npm @quick-start-soft/quick-markdownuses
- npm @quick-start-soft/quick-remove-image-backgrounduses
- npm @quick-start-soft/quick-git-clean-markdownuses
- npm @quick-start-soft/quick-document-translatoruses
- npm @quick-start-soft/quick-markdown-imageuses
- npm @quick-start-soft/quick-task-refineuses
- npm @asyncapi/modelinauses
- npm posthog-react-nativeuses
- npm posthog-nodeuses
- npm @postman/secret-scanner-wasmuses
- npm @postman/csv-parseuses
- npm @postman/node-keytaruses
- npm @postman/tunnel-agentuses
- npm @postman/wdio-allure-reporteruses
- npm @postman/postman-mcp-cliuses
- npm @postman/mcp-ui-clientuses
- npm @postman/wdio-junit-reporteruses
- npm @postman/pm-bin-macos-arm64uses
- npm @postman/pm-bin-linux-x64uses
- npm @postman/aether-iconsuses
- pypi litellmuses
- pypi telnyxuses
- npm sjs-bigintegeruses
- npm sjs-lint-build1uses
- npm bjs-bigintegeruses
- npm bjs-lint-builderuses
- npm bjs-lint-buildersuses
- npm cjs-bigintegeruses
- npm ts-lint-buildsuses
- npm @bitwarden/cliuses
- pypi pytorch-lightninguses
- npm @antv/layout-wasmuses
- npm art-templateuses
- npm forge-jsxyuses
- npm changiairportpromaxuses
- npm @redhat-cloud-services/patch-clientuses
- npm weavedb-sdkuses
- pypi gpt-pilotuses
