npm Authentication Token Discovery Activity

Detects access to npm token management and identity endpoints. This activity may indicate attempts to enumerate authentication tokens, validate account access, or prepare for software supply-chain compromise.

Microsoft Sentinel (KQL)