Miasma/MYRA npm Postinstall Hook Spawning Shell Interpreter

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where npm or node.exe spawn shell interpreters (cmd.exe, powershell.exe, bash, sh) with suspicious command-line arguments indicative of malicious activity, such as credential harvesting or unauthorized script execution within package lifecycle hooks (postinstall, preinstall). This is associated with supply chain attacks like the Miasma infostealer and MYRA RAT.