Miasma/MYRA npm Payload Harvesting Browser Credentials and SSH Keys

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects instances where a Node.js process accesses sensitive files associated with web browsers (e.g., Login Data, Cookies) or SSH keys (e.g., id_rsa). This behavior is often indicative of credential theft or unauthorized data collection, where an adversary uses legitimate tooling like Node.js to stage or exfiltrate sensitive local files.