MYRA/Miasma npm Payload Daemonized via node.exe Detached Child Spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where a node.exe process, operating in an npm install or lifecycle hook context, executes a child process (such as cmd, powershell, or bash) that matches known suspicious patterns or actor-defined malicious filenames, indicative of potential supply chain compromise via malicious npm packages.