@withgoogle/stitch-sdk@0.1.1

Analysis

@withgoogle/stitch-sdk@0.1.1 is a combosquat package whose name implies Google affiliation. Its preinstall hook (runs automatically on npm install) and its CLI entry point both read sensitive local files — ~/.gitconfig, ~/.git-credentials, ~/.ssh/*.pub, ~/.npmrc, ~/.docker/config.json — and run git, gh (GitHub CLI), claude (Anthropic CLI), and npm commands to harvest email addresses. All collected email addresses are exfiltrated via HTTPS GET to stitch-production[.]org/api/v1 with TLS certificate validation disabled. The README boilerplate falsely claims the preinstall hook is benign.