Node Accessing Sensitive Credential Files (Redhat SupplyChain)

Danny Y@zendannyy

•updated Jun 3, 2026•6•0•19

Detects a Node.js or npm process attempting to read sensitive credential files such as SSH keys, npm tokens, K8s configurations, cloud credentials, or Vault material. This rule is tuned for the Red Hat Cloud Services supply chain attack by monitoring for Node.js/npm processes executing in the context of the affected packages or preinstall hooks.