Stitch-SDK - GitHub CLI Session Harvesting (T1555)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•8

Identifies the preinstall.js script abusing the local GitHub CLI to query the primary email address via JSON parsing. This detection specifically looks for 'node.exe' initiating a process that executes 'gh' (GitHub CLI) with the 'api user --jq .email' command-line arguments, indicating an attempt to extract the user's email.