Miasma Worm GitHub API Credential Exfiltration via node/curl/PowerShell

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•5

Detects unauthorized HTTPS POST requests to sensitive GitHub API endpoints (gists, repository contents, user emails) originating from standard command-line tools like curl, node, and PowerShell. Additionally, it identifies suspicious git push operations initiated from within node-based installation scripts, which is indicative of credential harvesting and exfiltration behaviors exhibited by the Miasma worm.