Malicious npm Package Payload System Discovery via node.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects malicious node.exe processes engaging in system, user, process, or network discovery behaviors. This behavior is indicative of malicious npm packages, such as those seen in the Polymarket Trap, Miasma, or MYRA campaigns, which perform reconnaissance before attempting credential exfiltration.