Developer Secret File Access via Node/Bun

Brandon Rodriguez@BMRodriguez

•updated Jun 1, 2026•3•0•4

Detects Node.js or Bun processes accessing sensitive developer configuration directories such as .ssh and .npmrc, indicating potential credential harvesting. This rule specifically looks for file access or open events initiated by 'node.exe', 'node', 'bun.exe', or 'bun' processes targeting paths containing '.ssh' or '.npmrc', or files named '.npmrc'.