MYRA RAT cron persistence via */13 * * * * scheduled by npm postinstall

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation of suspicious cron jobs related to Node.js or npm processes, specifically looking for indicators of post-installation scripts or recurring tasks that might suggest malicious activity, such as supply chain compromise or persistence mechanisms.