T1059.004

Command and Scripting Interpreter: Unix Shell

discovered 2026-05-28

Poisoned PKGBUILD build/prepare steps run shell commands (npm install atomic-lockfile / bun install js-digest) under the building user's privileges via yay/paru/makepkg.

View on MITRE ATT&CK

Seen in packages

Campaigns