Python Infostealer Spawned by npm/node Accessing Browser or Cloud Credentials

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects instances where a Python process is spawned by npm or node and subsequently attempts to access sensitive browser or cloud credential files. This pattern is characteristic of malicious npm packages used for credential theft.