Skip to navigation

Threat reportVulnerabilityTL-2026-4839

Vulnerability Curve Tracks AI Curve: CVE Volume Surge, Negative Time-to-Exploit and 60-Day Remediation Gap

mediumACTIVE

ProjectDiscovery analysis reports annual published CVEs rose from 17,964 (2018) to 49,458 (2025), mean time-to-exploit fell from 5 days (2023) to roughly -1 day (2024) and -7 days (2025), and AI-assisted exploit generation is reported at 10-15 minutes. Defender remediation time stays flat at about 55-61 days, leaving a ~60-day exposure gap. First disclosed .

Key facts

IdentifiersTL-2026-4839
Also known asNegative Time-to-Exploit, Collapsing Exploit Window, Shai-Hulud 2.0 / Sha1-Hulud
SeverityMEDIUM
First disclosed
Affected productsMultiple Enterprise vulnerability management programs; open-source package ecosystems (npm, PyPI)
MalwareShai-Hulud, Shai-Hulud 2.0
ToolsBun runtime
MITRE ATT&CK techniquesT1059.007 JavaScript, T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1195.002 Compromise Software Supply Chain, T1203 Exploitation for Client Execution, T1485 Data Destruction, T1526 Cloud Service Discovery, T1547 Boot or Logon Autostart Execution, T1552.001 Credentials In Files, T1555 Credentials from Password Stores, T1567.001 Exfiltration to Code Repository, T1587.004 Exploits and 1 more in the attack flow
MotivationUNKNOWN
Target sectorstechnology, software-development, finance, government administration, health, critical-infrastructure
Target regionsGlobal
Detection rules9 (1 shown free)
Sources13 cited sources

Detection coverage

As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4839 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Shai-Hulud 2.0 npm Preinstall Loader Execution — Exploitation Phase

TL-2026-4839: detects node/bun executing setup_bun.js, set_bun.js or bun_environment.js, the Shai-Hulud 2.0 preinstall loader chain (T1195.002, T1059.007). Behaviour-first: fires on the process chain that a trojanized npm package triggers at install time, regardless of package name.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1195.002, T1059.007
  • Data sources: sysmon, index=sysmon XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1, DeviceProcessEvents
  • Severity: high
  • Confidence: high

Splunk SPL

```Shai-Hulud 2.0 (Sha1-Hulud) npm preinstall loader: node runs setup_bun.js / set_bun.js, Bun then runs the ~10 MB bun_environment.js payload. TL-2026-4839 T1195.002 T1059.007```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    (CommandLine="*setup_bun.js*" OR CommandLine="*set_bun.js*" OR CommandLine="*bun_environment.js*")
    (Image="*node.exe" OR Image="*bun.exe" OR Image="*/node" OR Image="*/bun")
| eval via_pkg_mgr=if(match(lower(ParentCommandLine),"npm|yarn|pnpm|preinstall"),"yes","no")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images values(User) as users values(via_pkg_mgr) as via_pkg_mgr by Computer
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table Computer users parent_images command_lines via_pkg_mgr count first_seen last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("node.exe", "bun.exe", "node", "bun")
| where ProcessCommandLine has_any ("setup_bun.js", "set_bun.js", "bun_environment.js")
| extend ViaPackageManager = InitiatingProcessCommandLine has_any ("npm", "yarn", "pnpm", "preinstall")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ViaPackageManager
| order by Timestamp desc

Sigma

title: Shai-Hulud 2.0 npm Preinstall Loader Execution
id: 6f1b0c52-7a3e-4d0b-9c58-1e2a4b7d9a01
status: experimental
description: Detects node or bun executing the Shai-Hulud 2.0 (Sha1-Hulud) loader or payload files setup_bun.js, set_bun.js and bun_environment.js, typically launched from a package.json preinstall script of a trojanized npm package.
references:
    - https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/
    - https://projectdiscovery.io/blog/the-vulnerability-curve-bent-with-the-ai-curve
author: Threadlinqs Team
date: 2026-10-30
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1059.007
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\node.exe'
            - '\bun.exe'
    selection_cli:
        CommandLine|contains:
            - 'setup_bun.js'
            - 'set_bun.js'
            - 'bun_environment.js'
    condition: all of selection_*
falsepositives:
    - Internal packages that legitimately ship a file named setup_bun.js
    - Developers testing the Bun runtime with similarly named scripts
level: high

Known false positives:

  • Internal tooling or packages that happen to ship a script named setup_bun.js
  • Developers experimenting with the Bun runtime using the same file names

Tuning notes: Filter known-good internal repos by ParentCommandLine or working directory. Run on CI runners and developer endpoints first. For Linux build hosts feed the same logic from Sysmon for Linux or auditd execve. via_pkg_mgr=yes with a recent npm install is the highest-fidelity subset.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Bun Runtime Bootstrap by Node/npm Install Script — Exploitation Phase · unlock with TL Creds
  • Mini Shai-Hulud .claude SessionStart Persistence — Post-Exploitation · unlock with TL Creds
  • Bun/Node Payload Exfiltrating to GitHub — C2 / Exfiltration · unlock with TL Creds
  • Log4Shell JNDI Exploitation Attempt in Web Requests — Exploitation Phase · unlock with TL Creds
  • Cloud Secret Enumeration by Node/Bun — Post-Exploitation · unlock with TL Creds
  • GitHub Audit: SHA1HULUD Self-Hosted Runner Registered — C2 / Persistence · unlock with TL Creds
  • SHA1HULUD Self-Hosted GitHub Actions Runner — Post-Exploitation · unlock with TL Creds
  • Node/Bun Access to Cloud Metadata Endpoints — C2 / Credential Theft · unlock with TL Creds

Indicators of compromise

As of 2026-10-30, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-4839.

13 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

This is a trend and strategic-risk record, not a single CVE or campaign. It is based on a ProjectDiscovery blog post by Prince Chaddha (2026-06-18). All figures are the vendor's and were compiled from third-party datasets (NVD, CISA KEV, Google Threat Intelligence Group/Mandiant, Edgescan, Sonatype, Cybersecurity Ventures). They have not been independently re-verified here.

Volume: published CVEs rose from 17,964 (2018) to 30,361 (2023), 40,131 (2024) and 49,458 (2025), including 3,579 Critical and 15,868 High in 2025. 30,550 CVEs had been published by 2026-06-03, and the source projects about 290,000 cumulative CVEs by the end of 2026. Linux kernel CNA activity contributed 4,362 CVEs in 2024 and 4,334 in 2025, of which only 9 of the 2024 CVEs reached CISA KEV. CISA KEV added 123 entries in 2025. The NVD analysis backlog exceeded 27,000 unanalyzed CVEs at the end of 2025, and in April 2026 NIST moved pre-March-2026 CVEs to 'Not Scheduled' and began enriching only KEV and high-risk CVEs.

Exploit timing: the source reports mean time-to-exploit falling from 63 days (2018-2019) to 44, 32 and 5 days (2023, outlier-adjusted; 47 days with outliers), then to roughly -1 day (2024) and -7 days (2025), with about -13 days projected for 2026. A negative value means exploitation is observed before public disclosure. In 2023, 70% of exploited vulnerabilities were zero-days, and 430+ zero-days were exploited in the wild through 2025. Critical-vulnerability time-to-remediate stayed at about 55-61 days, which leaves an exposure gap of roughly 60 days. About 60% of breaches involve a vulnerability with an available patch. Log4Shell-vulnerable components were still pulled about 40 million times in 2025.

AI acceleration: the source cites the CVE-Genie framework reproducing 51% of 2024-2025 CVEs with verified exploits at about $2.77 per exploit and 10-15 minutes each, and GPT-4 judging 87% of tested CVEs exploitable from the description alone.

Supply chain: Sonatype counts of malicious open-source packages were 245,032 (2023), 512,847 (2024) and 454,648 (2025), with 21,764 in Q1 2026 and more than 1.35 million cumulative. The source names the Shai-Hulud npm worm (2025, 500+ packages) and Shai-Hulud 2.0. Microsoft documents Shai-Hulud 2.0 as active 2025-11-24 to 2025-12-01. It uses an npm preinstall script (set_bun.js / setup_bun.js) that installs the Bun runtime and runs bun_environment.js. The payload harvests cloud, SSH, npm and wallet credentials, exfiltrates them to attacker-controlled public GitHub repositories, and registers a GitHub Actions self-hosted runner named SHA1HULUD. A 'Mini Shai-Hulud' variant (2026-05-11; 170+ npm and 2 PyPI packages per Microsoft) persists through a .claude/settings.json SessionStart hook. No actor, CVE or network infrastructure is attributed in the primary source.

Defender implication: patch-by-CVSS/NVD-enrichment workflows lag exploitation. Prioritize KEV and exploitation-evidence feeds, virtual patching and compensating controls, exposure validation, and package-registry and CI/CD controls (lockfiles, install-script restrictions, token rotation).

MITRE ATT&CK techniques by tactic:

Execution

T1059.007 JavaScript; T1203 Exploitation for Client Execution

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain

Impact

T1485 Data Destruction

Discovery

T1526 Cloud Service Discovery

Persistence

T1547 Boot or Logon Autostart Execution

Credential Access

T1552.001 Credentials In Files; T1555 Credentials from Password Stores

Exfiltration

T1567.001 Exfiltration to Code Repository

Resource Development

T1587.004 Exploits; T1588.006 Vulnerabilities

Remediation

Patches

  • Apply vendor patches for KEV-listed vulnerabilities first
  • Upgrade long-tail vulnerable components such as Log4j still pulled in 2025

Immediate actions

  • Prioritize remediation by exploitation evidence (CISA KEV, vendor-confirmed exploitation) rather than CVSS or NVD enrichment status
  • Audit npm/PyPI dependencies for Shai-Hulud 2.0 indicators: preinstall setup_bun.js/set_bun.js, 10 MB bun_environment.js, repositories described 'Sha1-Hulud: The Second Coming', runners named SHA1HULUD
  • Rotate npm, GitHub, cloud (AWS/Azure/GCP), Kubernetes and SSH credentials on any host that installed a compromised package
  • Review .claude/settings.json and .claude/ directories in repositories for unexpected SessionStart hooks

Workarounds

  • Use virtual patching/WAF rules and network segmentation where patching cannot meet exploitation timelines
  • Block egress and restrict access to cloud metadata endpoints (169.254.169.254, 169.254.170.2) from build hosts

Longer-term hardening

  • Compress time-to-remediate for internet-facing critical vulnerabilities from the ~55-61 day baseline
  • Adopt continuous exposure validation (e.g. Nuclei-style template checks) to confirm exploitability and patch effectiveness
  • Enforce lockfiles, disable or allowlist npm install/preinstall scripts in CI, use package cooldown/age policies, and scope short-lived CI tokens
  • Monitor for new self-hosted GitHub Actions runners and unexpected public repositories created by organization accounts

Affected and fixed versions

  • Multiple — Enterprise vulnerability management programs; open-source package ecosystems (npm, PyPI)
    Vulnerable versions: Organizations with ~55-61 day critical remediation cycles; npm packages compromised by Shai-Hulud 2.0

Timeline

  • Log4Shell (Log4j) publicly disclosed; the source notes vulnerable versions were still pulled about 40 million times in 2025.
  • The Register reports the NVD missed its analysis deadline, with a large backlog of unanalyzed CVEs (18,358 unanalyzed as of September 2024 per the source).
  • Google Threat Intelligence Group publishes its 2024 zero-day analysis: 75 zero-days exploited in the wild, down from 98 in 2023.
  • Shai-Hulud 2.0 (Sha1-Hulud) npm worm campaign begins spreading via trojanized packages with preinstall scripts (campaign window 2025-11-24 to 2025-12-01 per Microsoft).
  • Microsoft publishes detection, investigation and defense guidance for Shai-Hulud 2.0.
  • Help Net Security reports NIST's NVD policy change: pre-March-2026 CVEs moved to 'Not Scheduled' and enrichment limited to KEV and high-risk CVEs.
  • 'Mini Shai-Hulud' resurgence: 170+ npm and 2 PyPI packages compromised, using a locked-ioc-2 SessionStart persistence hook (per Microsoft).
  • Data cutoff in the ProjectDiscovery analysis: 30,550 CVEs published in 2026 to date.
  • ProjectDiscovery publishes 'The Vulnerability Curve Bent With the AI Curve' reporting negative mean time-to-exploit and a ~60-day remediation gap.

Sources cited

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats