Cloud Metadata Access by Node or Bun Process
Detects a Node or Bun process reaching the cloud instance metadata service. The keyv/cacheable stage-2 collector targets EC2 IMDS and ECS task metadata as the entry point to a broader sweep covering AWS credential chains and Secrets Manager across all regions, GCP service account keys, Azure client secrets, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub Actions OIDC request tokens and npm tokens. On a build agent this pattern is the clearest signal that credential theft is in progress.
Sigma
