Malicious npm Package Accessing Claude Code Credentials (@withgoogle/stitch-sdk)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•6

This rule detects node.js processes, typically initiated via npm or during package installation scripts, accessing sensitive Claude Code configuration or credential files. This behavior is indicative of a malicious supply chain attack where a compromised npm package attempts to exfiltrate developer authentication secrets.