npm Authentication Token Discovery Activity
Detects access to npm token management and identity endpoints. This activity may indicate attempts to enumerate authentication tokens, validate account access, or prepare for software supply-chain compromise.
Microsoft Sentinel (KQL)

