Tool
gh-token-monitor
- First Reported
- Oct 8, 2026
- Latest Reported
- Oct 8, 2026
Reported Context (1)
- When the malware has a GitHub token, it installs a small service called gh-token-monitor. Every 60 seconds, for up to 24 hours, the service checks that token against the GitHub API. If GitHub rejects it, the service StepSecurity Details Tensorlake npm Malware That Steals Credentials and Can Wipe Home Directories
MITRE ATT&CK (15)
Vendors (2)
Products (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.