Miasma Infostealer SSH Key Harvesting via npm Lifecycle Hook Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects unauthorized access to SSH private key files by processes spawned directly or indirectly from npm lifecycle hooks (e.g., postinstall, preinstall). This behavioral pattern is associated with supply chain attacks such as the Miasma infostealer, where malicious dependencies attempt to exfiltrate credentials during the installation phase.