Miasma/MYRA Infostealer Browser Credential DB Access via node.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the node.exe process (npm lifecycle) accessing sensitive web browser credential databases (e.g., Login Data, Cookies, Web Data, and Firefox profiles). This activity is indicative of infostealer malware, such as Miasma or MYRA, which often leverages malicious npm packages to drop and execute SQLite-based credential exfiltration logic directly from disk.