Miasma/MYRA npm Self-Upgrade: node_modules Overwrite Post-Install (T1195.002)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects potentially malicious activity related to Node.js environments. It monitors for the execution of Node.js or NPM commands involving specific sensitive files ('sync-peer.cjs', 'peer-math.js') or suspicious packing destinations, as well as the creation of 'index.js' or 'package.json' files within a 'node_modules' directory, which can indicate software supply chain manipulation or malicious dependency installation.