Scan report · about 1 month agoPublic

bun.sh

104.26.4.138AS13335 · US

Submittedhttps://bun.sh

Landed onhttps://bun.sh/

page delivers an executable (https://bun.sh/install.ps1)

delivers a script, not an installer ("install.ps1")

Engine tags

Verdict

2 of 8 enginesSuspiciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 2.5 s · 76 requests

01 · Visitor opensbun.sh

02 · Page shown

Bun — A fast all-in-one JavaScript runtime

03 · File delivered · suspiciousinstall.ps1bun.shHanded over by the page, not served at the scanned address.

04 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Be careful — warning signs found

Automated

This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.

What to do

Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.

"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.

Findings

Strongest first

Suspicious fileSuspicious content in the downloaded file

install.ps1

We analysed the file this page delivered — it is Suspicious.

Success

SHA-256 b293e028d51c5728efcceb401e2552c170497b8f18bdb381a88c55169c41cc6f

SupportingPage delivers an executable under a document pretext

https://bun.sh/install.ps1 · delivers a script, not an installer ("install.ps1")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoCross-domain scripts injected at runtime

2 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Delivered fileCleaninstall.ps1

SHA-256b293e028d51c5728efcceb401e2552c170497b8f18bdb381a88c55169c41cc6f

Fromhxxps://bun[.]sh/install[.]ps1

Infrastructure

IP: 104.26.4.138CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Nov 22, 2026
Redirects: 0 hops · / → /

8 malicious20 suspicious

Hashes & fingerprints

Page Hash19e4ea6a2985d411331643853d4153026c6c0e14ef166d70538cdd2cf75b3389 Favicon Hash07ff51e94251a309d445a86f95b0fae1a497ac01cd01a257af39ca9bb8b22efc DOM Hash7f540101e576c88a70b09103d3d6a70f3b9f6f5530b92ee1bb75bb892fd35916 Screenshot pHashd5e0e01ff074e01f JARM27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintBDCB5D75A81AB956FF028FDD36F15EFF46DFF3F5 Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “Bun — A fast all-in-one JavaScript runtime”

Visit Site

Engines

8 · time to verdict