Editor process reading .git/config and .git/HEAD outside git.exe (Git metadata harvesting)

Ethan Andrews@eandrews

•updated Aug 4, 2026•2•0•2

Detects an editor/extension-host process (not git.exe) reading multiple internal Git repository files (.git/config, .git/HEAD, .gitconfig) within a short window, matching malicious extensions parsing repo remote URLs, branch/commit info, and commit email domains without invoking the git binary.