npm RAT Chrome Credential Theft via Login Data Access or Dump File

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects unauthorized processes accessing the Google Chrome 'Login Data' SQLite database file or the creation of a 'chrome_logins_dump.txt' file, which are indicators of potential credential theft activity often seen in RATs or information stealers.