Glassworm - Exfiltration of Developer Tokens to Pastebin/GitHub Gists

Ibrahim Saud@tektrix

•updated Jun 20, 2026•2•0•7

This rule detects the exfiltration of sensitive developer tokens (specifically .npmrc or .pypirc files) to public paste sites like Pastebin or GitHub Gists. It correlates network events where a process attempts to connect to these sites with file access events on the specified token files by the same process.