Miasma npm Credential Harvester: node.exe Accessing SSH/Docker/Kube/Claude Creds

Ibrahim Saud@tektrix

•updated Jun 27, 2026•2•0•1

This rule detects suspicious activity involving Node.js or Bun runtimes, specifically focusing on the access of sensitive configuration files (e.g., .npmrc, .aws/credentials, .ssh, .kube/config) or the execution of commands containing keywords associated with credential harvesting and automated data collection scripts.