@withgoogle/stitch-sdk scope squat

SafeDep found @withgoogle/stitch-sdk harvesting developer credentials
by squatting Google’s unclaimed @withgoogle scope. Scope-squatting is
the org-namespace version of dependency confusion: the package looks
official because of the publisher prefix, not because Google published
it.

Mapped techniques

T0120 Dependency confusion
T0136 Brandjacking
T0109 Publish malicious artifact

supply-chain unclaimed scope

T0120 · Initial Access · Dependency confusion

Unclaimed @withgoogle scope on npm.

T0136 · Initial Access · Brandjacking

Google Stitch SDK impersonation.

T0109 · Resource Development · Publish malicious artifact

Credential harvester under the squat.

Sources

https://safedep.io/withgoogle-stitch-sdk-scope-squat-credential-harvester