Miasma/MYRA npm Payload: Multi-Credential File Harvest + C2 DNS Exfil

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects instances where node.js or npm processes access multiple sensitive configuration or credential files (such as .aws/credentials, .npmrc, .pypirc, .gitconfig, or docker configs) and subsequently perform DNS queries against known malicious or suspicious C2 domains.