MYRA RAT Masquerading as systemd-userdbd Spawned from node/npm

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects instances where a Node.js or NPM process spawns the systemd-userdbd utility. This behavior is highly irregular in standard Linux environments and may indicate an attempt to interact with system user databases, potentially for privilege escalation, persistence, or credential discovery by an application running in the Node.js runtime.