Miasma/MYRA npm Infostealer: Crypto Wallet Vault File Access via node.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects the execution of Node.js processes ('node' or 'node.exe') with command-line arguments that match known patterns often associated with software installation scripts, post-installation tasks, or peer verification activities. While these file names can be legitimate, they are also commonly leveraged by attackers for malicious script execution or persistence.