GitHub CLI Token Extraction Command

Danny Y@zendannyy

•updated May 1, 2026•17•0•1,092

Detects the execution of the 'gh auth token' command. This behavior was observed being used by the TeamPCP malicious npm package (hijacked @bitwarden/cli) via a shell collector script to harvest active GitHub CLI authentication tokens from developer endpoints.