Miasma/MYRA npm Token and Docker Credential Theft via Malicious npm Package

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects Node.js processes accessing sensitive configuration files such as .npmrc (npm authentication tokens) or .docker/config.json (docker registry credentials). This rule filters for activity within npm lifecycle script contexts (e.g., preinstall, postinstall hooks), which is a common technique used in software supply chain attacks to exfiltrate credentials.