Node/Bun process reading multiple cloud, SSH, Vault and Kubernetes credential fi

Adarsh Pandey@Pandeyadarsh

•updated today•1•0•1

Detects a Node.js or Bun process reading multiple distinct sensitive credential or configuration stores (such as AWS, Kubernetes, SSH, Docker, Vault, GPG, and NPM credentials) within a single day, characteristic of credential harvesting behavior.