Miasma Worm Developer Credential Theft via node.exe Accessing Sensitive Files

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

This rule detects unauthorized or suspicious file access to sensitive configuration, credential, and identity files by 'node.exe' or 'bun.exe' processes. It flags instances where these runtime processes access multiple unique sensitive files, excluding those officially associated with the Node.js or OpenJS Foundations, which is a common indicator of credential exfiltration or reconnaissance by malicious scripts in an environment.