Miasma Worm Developer Credential Theft via node.exe/bun.exe

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects anomalous network communication with a known C2 domain associated with the Miasma worm, or attempts by JavaScript runtime processes (node, bun) to access sensitive developer-related files (SSH keys, cloud credentials, browser data) without an authorized IDE parent process.