Kubernetes and Vault Token File Access by Node or Bun

Lourenço Santos@lourenco

•updated Aug 4, 2026•4•0•16

Detects a Node or Bun process reading Kubernetes service account tokens or HashiCorp Vault token files. The keyv/cacheable collector reads these paths directly as part of its credential sweep. Companion rule to the IMDS detection (d02b7df0-60e3-4ec9-a077-339507299e11).