Miasma Infostealer Node.js Access to Browser Crypto Wallet Extension Storage

Ibrahim Saud@tektrix

•updated Jun 30, 2026•10•0•2

Detects node.exe or npm processes accessing directory paths associated with popular browser cryptocurrency wallet extensions, a behavior indicative of the Miasma infostealer used in supply chain attacks.