Node/npm process accessing developer credential files then making outbound connections

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•3•0•5

Detects when Node.js or NPM processes access sensitive credential files such as .npmrc, SSH private keys, or AWS credentials, followed by an outbound public network connection from the same device within a 15-minute window.