MYRA RAT apintergrationpost npm package lifecycle script spawning native compilation

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•6

Detects suspicious execution patterns involving 'npm' or 'node' processes, specifically looking for command-line arguments or folder paths related to 'apintegrationpost' or known components of the MYRA malware family (libcache.so, memfd_loader, proc_hide, injector, agent_launcher). This rule aims to identify potential supply chain compromise or malicious activity leveraging Node.js environments.