Miasma npm Credential Harvester Accessing SSH Keys, AWS Creds, and Claude Config

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•1

Detects instances where 'node' or 'bun' runtime processes access multiple sensitive developer configuration or credential files (e.g., .ssh, .aws/credentials, .npmrc, .kube/config). This behavior is indicative of potential credential theft or reconnaissance activities by an adversary attempting to leverage developer environments.