Miasma Worm npm Token Theft and Worm Self-Propagation via node.exe

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•3

This rule detects potentially malicious activity related to the npm ecosystem. It identifies Node.js processes accessing .npmrc files (which contain authentication tokens) followed by immediate outbound network communication. Additionally, it detects suspicious command-line patterns associated with automated npm publishing (indicative of worm-like propagation) and the presence of npm credentials in the environment or command lines of non-npm processes.