MYRA RAT npm apintergrationpost postinstall native binary compilation

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects MYRA RAT delivery via malicious npm package lifecycle scripts (e.g., postinstall) that trigger the compilation of native binaries such as libcache.so, memfd_loader, and others on Linux hosts.