npmrc token read by non developer shell
This rule looks for a non-interactive shell process reading npmrc token files outside normal developer activity. Automated readers often belong to stealers. Rotate npm tokens and check publish history. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Microsoft Sentinel (KQL)
