@withgoogle/stitch-sdk npm Scope Squat Credential Harvester

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of a malicious npm package ('@withgoogle/stitch-sdk') which uses scope-squatting to impersonate a legitimate library. The rule flags the execution of preinstall scripts that involve references to the malicious exfiltration domain 'stitch-production.org' or the identified maintainer 'maximus-mcmillan', indicating unauthorized credential harvesting.