gh-token-monitor Credential Polling

Ibrahim Saud@tektrix

•updated Jun 17, 2026•1•0•8

Detects the use of the 'watch' command in conjunction with 'cat' to continuously poll the GitHub CLI config file (.config/gh/hosts.yml). This activity could indicate an attacker attempting to capture new GitHub tokens as soon as a developer logs in.