Operation Friday Harvest - Developer Credential Theft via npm Infostealer

Ethan Andrews@eandrews

•updated Jun 23, 2026•1•0•4

Detects node.js processes spawned from npm postinstall hooks accessing developer credential files including .gitconfig, .npmrc, and GitHub CLI token files, consistent with the Operation Friday Harvest infostealer campaign targeting Claude Code, GitHub CLI, and npm tokens via malicious npm packages.