@withgoogle/stitch-sdk Scope-Squat Harvesting Developer Credentials

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects Node.js processes executing command-line arguments related to the collection of sensitive configuration files, credentials, and identity tokens from systems, such as Git configurations, SSH keys, NPM credentials, and Docker tokens. This behavior is indicative of an automated reconnaissance or credential harvesting phase in an attack.