Miasma npm Infostealer: Git/GitHub/Claude Credential File Access by node.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects Node.js runtime instances interacting with multiple sensitive developer configuration and credential files (e.g., .gitconfig, GitHub CLI host tokens, Claude configuration, git-credentials) in a single session. This pattern is consistent with infostealer malware (such as Miasma/MYRA) attempting to harvest developer credentials for downstream exploitation.