T1059.007: Miasma Import-Time Detached Hidden Node.js Child Process

Tim Peck@timpeck

•updated Jul 16, 2026•10•1•30

Detects the Miasma loader, associated with supply chain attacks on NPM packages (e.g., ShinyHunters campaign), spawning a hidden, detached Node.js child process during module import. The detection monitors for a Node.js process spawning a child node.exe with the '-e' flag and a specific obfuscated variable prefix used by the malware to execute malicious code while bypassing --ignore-scripts.