npm Scope Squat @withgoogle/stitch-sdk Harvesting Developer Credentials

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of a malicious npm package disguised as '@withgoogle/stitch-sdk'. The package uses a 'preinstall.js' script to harvest sensitive developer credentials, including API keys, Git credentials, SSH keys, and Docker tokens, and attempts to exfiltrate this data to an attacker-controlled domain (stitch-production.org).