Stitch-SDK - Preinstall Hook Intercepting Claude Code (T1195.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•7

Detects the scope-squatted package preinstall script executing the Claude CLI to harvest the developer's authenticated session email. Specifically, it looks for 'node.exe' as the initiating process, executing a process named 'claude' or a process with 'auth' and 'status' in its command line.