Miasma: Node.js Spawning npm/PyPI/Cargo Publish for Registry Self-Propagation

Duo Tech@duotech

•updated Jul 15, 2026•1•0•1

Detects instances of Node.js processes executing command-line instructions related to publishing packages (npm, twine, or cargo). This behavior is characteristic of Miasma malware's 'trySpread' routine, which attempts to propagate the malware by leveraging compromised package repository tokens.