Miasma Infostealer Cloud Credential Harvesting via Node.js/npm

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where Node.js, npm, or npx processes attempt to access sensitive configuration files including AWS credentials, Claude API keys, or .env files, which is a common behavior of the Miasma infostealer used in supply chain compromise campaigns to harvest cloud and AI secrets.