@withgoogle/stitch-sdk

Details

@withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attacker registered the @withgoogle scope to mimic Google's withgoogle.com domain and published versions 0.1.1 and 0.1.2 under the account maximus-mcmillan on June 19, 2026. The package runs a credential harvester from a preinstall hook (scripts/preinstall.js) and an identical CLI binary (bin/cli.js). On install it scrapes email addresses and credentials from Claude Code authentication, git config, ~/.git-credentials, ~/.ssh/*.pub, the GitHub CLI, ~/.npmrc, and ~/.docker/config.json, then exfiltrates them to https://stitch-production.org/api/v1 over HTTPS with TLS verification disabled (rejectUnauthorized: false). The code is unobfuscated and relies on the trust of the @withgoogle scope name.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ffe3e7f674ed72b1e7f4cc8f75f8040e8e2efd91c98f3b0484dfdc7fe5347279)
Package is published under the @withgoogle npm scope but the package.json author is 'Maximus McMillan' with repository github.com/maximus-mcmillan/stitch-sdk — there is no Google affiliation. scripts/preinstall.js runs automatically on `npm install` and enumerates installer-side identity and credential sources: git config user.email (--global/--system), ~/.gitconfig, ~/.config/git/config, ~/.git-credentials (which stores plaintext https://user:token@host entries), ~/.ssh/*.pub, `gh api user`, `claude auth status`, `npm config get email`, ~/.npmrc (npm auth tokens), and ~/.docker/config.json (registry auth). The harvested values are HTTP-GET'd to https://stitch-production.org/api/v1?src=...&user=... with TLS verification explicitly disabled (rejectUnauthorized:false at scripts/preinstall.js:46) to ensure delivery. The hardcoded C2 base URL is at scripts/preinstall.js:26 (`const STITCH_SERVER_BASE = 'https://stitch-production.org/api/v1'`). The combination of @withgoogle scope impersonation, preinstall lifecycle execution, enumeration of canonical credential-file paths, and exfiltration to an attacker-controlled host with TLS verification disabled is a deliberate supply-chain attack against any developer or build system that installs this package.

Compromised versions (5)

• 0.1.5
• 0.1.4
• 0.1.1
• 0.1.3
• 0.1.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.