Stitch-SDK - Fabricated Repo Path Deployment

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Detects local development directories where the compromised package matches a fake GitHub user repository URL, specifically looking for 'package.json' file events (creation or modification) within folder paths containing 'maximus-mcmillan'. This is indicative of the Stitch-SDK scope squatting credential harvester technique.