Miasma/MYRA npm SSH Key & Developer Secret Exfiltration via node.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where Node.js or NPM processes (or their parent processes) access sensitive files such as SSH private keys, AWS credentials, environment files, or configuration files containing secrets. This behavior is often associated with infostealers or malicious scripts exfiltrating credentials from developer environments.