Miasma/MYRA: node/npm Multi-Browser Credential Store Access + Shell History Sweep

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects when a Node.js or NPM process accesses multiple sensitive browser credential files (Login Data or Cookies) within a short window, while simultaneously reading shell history files (bash_history, zsh_history, or fish_history). This behavior is characteristic of an automated credential harvester or infostealer script executing within a Node.js environment.