MYRA RAT npm Postinstall Silent apt-get Install of ffmpeg x11-utils build-essential

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects the MYRA RAT utilizing npm postinstall scripts to silently install surveillance, build, or media capture tools (such as ffmpeg or grim) via apt-get in a non-interactive mode. This behavior is indicative of a supply chain attack or malicious dependency execution during package installation.