Miasma/MYRA npm Payload System Enumeration via node.exe Child Processes

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects reconnaissance activity originating from npm or Node.js processes, specifically targeting system information (OS, network, user context, and hardware identifiers). This activity is associated with supply chain compromise attempts where malicious npm postinstall scripts or inline Node.js execution are used to enumerate the host environment.