@withgoogle/stitch-sdk Scope Squat Credential Harvesting via npm

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects potential supply chain compromise in Node.js projects by monitoring for the execution of known malicious npm package install/preinstall/postinstall scripts. It identifies unauthorized access to sensitive developer credential files (such as .ssh, .git-credentials, and .npmrc) and suspicious network outbound connections associated with identified malicious package scopes.