Miasma Infostealer via Malicious npm Postinstall Hook (Polymarket Trap)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects malicious activity associated with the Miasma/MYRA infostealer campaign targeting DeFi developers. The rule monitors npm lifecycle scripts (postinstall/preinstall) for suspicious execution, C2 communication with known malicious domains, unauthorized access to browser-based credential storage, and persistence attempts via LD_PRELOAD on Linux environments.