Credential Theft via Package Runtime Secret Access and IMDS Request

This threat involves credential-stealing malware delivered through compromised packages (e.g., PyPI, npm) that leverages package runtimes (Python, Node.js, Bun, Deno, Ruby, PHP, or Perl) to access local developer secrets. Following the harvesting of sensitive files such as SSH keys, registry tokens, or AI coding assistant credentials, the malicious process connects to cloud Instance Metadata Service (IMDS) endpoints within one minute to exfiltrate or hijack instance-level credentials. This sequence is characteristic of supply chain attacks where a malicious package is imported, executing its payload during interpreter runtime. Cloud SDKs are excluded from this behavior analysis as they typically read provider-specific credential chains before falling back to IMDS.

Impact

Successful exploitation results in the exfiltration of sensitive local developer credentials (SSH keys, Git/GitHub/Vault tokens) and the potential hijacking of cloud instance roles, allowing attackers to access cloud resources associated with the victim's identity.

Recommendation

• Implement monitoring for the access of sensitive credential paths by language interpreters and build-tool runtimes.
• Enforce IMDSv2 with a hop limit of 1 and scope instance IAM roles to least privilege to minimize the impact of credential theft.
• Audit and rotate credentials immediately if suspicious file access followed by IMDS network activity is observed.
• Review environment dependencies for recently updated or suspect package versions in site-packages, node_modules, or virtual environments.