Miasma/MYRA: node.exe Reading SSH Keys and AWS Credentials

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects instances where a Node.js process accesses, creates, or modifies sensitive files such as SSH private keys, AWS credentials, or application configuration files (.npmrc, .pypirc, .docker/config.json). This behavior is often indicative of credential theft or unauthorized configuration access by a compromised Node.js application.