Miasma npm Credential Harvester: Claude/Git/SSH/Docker/K8s Token Theft

Ibrahim Saud@tektrix

•updated Jun 27, 2026•3•0•3

Detects malicious behavior attributed to the Miasma/TonRAT malware, specifically targeting node.js or bun.exe runtime environments. The rule identifies suspicious network connections to command and control (C2) domains, access to sensitive developer credential files (e.g., .npmrc, .aws/credentials), execution of identified credential-harvesting functions in process command lines, and the execution of specific suspicious preinstall scripts.