MYRA RAT LD_PRELOAD Rootkit Persistence via npm/node on Linux

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects persistence mechanisms used by the MYRA Linux RAT, specifically targeting the modification of /etc/ld.so.preload, the deployment of a malicious library (.libcache.so) to /usr/local/lib/, and suspicious shared object file creation in temporary directories (/tmp or /dev/shm) initiated by Node.js or npm processes. This behavior was observed in the Polymarket Trap npm supply chain campaign.