Stitch-SDK - Developer Keys Disk Read Array (T1552.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Detects when the 'node.exe' process attempts to read sensitive developer key files such as '.git-credentials', '.npmrc', or 'config.json' directly from disk. This behavior is indicative of a malicious NPM script attempting to harvest local authentication tokens.