Jaromir Hořejší

JavaScript malware is no longer limited to scripts executed by traditional Node.js environments or through Windows Script Host. As the JavaScript and TypeScript ecosystem expands, newer runtimes such as Bun and Deno are gaining legitimate developer adoption for their performance, portability, and native support for bundling applications into standalone executables. These same features are now attracting threat actors.

This presentation delves into how adversaries abuse Bun and Deno to bundle malicious JavaScript applications together with the runtime itself, producing large self-contained binaries that often evade legacy detection logic or file size limitations. We analyze the bundled formats generated by these runtimes and discuss how to extract bundled source code and embedded payloads from standalone executables to extract the original source code.

We then move from format analysis to real-world abuse. Using hunting rules based on runtime-specific markers and bundle structures, we identified multiple malicious clusters using Bun and Deno in the wild. 

These include various stealers, droppers, the proof-of-concept malicious projects whose authors explicitly advertise "minimal detection rates", and most importantly the Silent Harvester campaign, distributing Bun-bundled downloaders through GitHub-hosted archives disguised as game trainers, mods, and cracked-software utilities. Silent Harvester delivers secondary payloads such as stealers and cryptocurrency miners, demonstrating a complete operational pipeline built around runtime bundling and social engineering.

The session will show how modern JavaScript runtime bundles can function as an evasion and packaging layer, similar in spirit to packers, crypters, and niche-language malware trends seen in previous years. Attendees will learn practical indicators for identifying Bun- and Deno-bundled executables, understand why conventional JavaScript malware detection may miss these samples, and leave with actionable approaches for hunting, unpacking, and analyzing this emerging class of threats.