LoFP / developer or deployment scripts running on cloud-hosted macos or windows instances may read a package registry or source control token and then request instance role credentials from the same interpreter (for example a release script that publishes a package and uploads artifacts with the instance role). validate the script path, parent process and whether the host is an approved build or release system.

sequence by process.entity_id with maxspan=1m
  [file where event.action == "open" and host.os.type in ("macos", "windows") and
    file.path like~ (
      /* SSH private keys */
      "/Users/*/.ssh/id_*", "?:\\Users\\*\\.ssh\\id_*",

      /* Package registry, source control and secrets manager tokens */
      "/Users/*/.npmrc", "?:\\Users\\*\\.npmrc",
      "/Users/*/.pypirc", "?:\\Users\\*\\.pypirc",
      "/Users/*/.git-credentials", "?:\\Users\\*\\.git-credentials",
      "/Users/*/.config/git/credentials", "?:\\Users\\*\\.config\\git\\credentials",
      "/Users/*/.config/gh/hosts.yml", "?:\\Users\\*\\AppData\\Roaming\\GitHub CLI\\hosts.yml",
      "/Users/*/.vault-token", "?:\\Users\\*\\.vault-token",
      "/Users/*/.terraform.d/credentials.tfrc.json", "?:\\Users\\*\\AppData\\Roaming\\terraform.d\\credentials.tfrc.json",

      /* Additional package registry and AI/ML platform tokens */
      "/Users/*/.yarnrc.yml", "?:\\Users\\*\\.yarnrc.yml",
      "/Users/*/.gem/credentials", "?:\\Users\\*\\.gem\\credentials",
      "/Users/*/.cargo/credentials.toml", "?:\\Users\\*\\.cargo\\credentials.toml",
      "/Users/*/.composer/auth.json", "/Users/*/.config/composer/auth.json", "?:\\Users\\*\\AppData\\Roaming\\Composer\\auth.json",
      "/Users/*/.cache/huggingface/token", "/Users/*/.huggingface/token", "?:\\Users\\*\\.cache\\huggingface\\token", "?:\\Users\\*\\.huggingface\\token",
      "/Users/*/.config/github-copilot/apps.json", "/Users/*/.config/github-copilot/hosts.json",
      "?:\\Users\\*\\AppData\\Local\\github-copilot\\apps.json", "?:\\Users\\*\\AppData\\Local\\github-copilot\\hosts.json",
      "/Users/*/.ollama/id_ed25519", "?:\\Users\\*\\.ollama\\id_ed25519",

      /* AI coding assistant credentials */
      "/Users/*/.claude/.credentials.json", "?:\\Users\\*\\.claude\\.credentials.json",
      "/Users/*/.codex/auth.json", "?:\\Users\\*\\.codex\\auth.json",
      "/Users/*/.codex/.credentials.json", "?:\\Users\\*\\.codex\\.credentials.json",
      "/Users/*/.codex/secrets/*.age", "?:\\Users\\*\\.codex\\secrets\\*.age",
      "/Users/*/.gemini/oauth_creds.json", "?:\\Users\\*\\.gemini\\oauth_creds.json",
      "/Users/*/.gemini/gemini-credentials.json", "?:\\Users\\*\\.gemini\\gemini-credentials.json",
      "/Users/*/.gemini/mcp-oauth-tokens.json", "?:\\Users\\*\\.gemini\\mcp-oauth-tokens.json",
      "/Users/*/.gemini/a2a-oauth-tokens.json", "?:\\Users\\*\\.gemini\\a2a-oauth-tokens.json",
      "/Users/*/.qwen/oauth_creds.json", "?:\\Users\\*\\.qwen\\oauth_creds.json",
      "/Users/*/.qwen/mcp-oauth-tokens.json", "?:\\Users\\*\\.qwen\\mcp-oauth-tokens.json",
      "/Users/*/.aws/sso/cache/kiro-auth-token.json", "?:\\Users\\*\\.aws\\sso\\cache\\kiro-auth-token.json",
      "/Users/*/.local/share/opencode/auth.json", "?:\\Users\\*\\.local\\share\\opencode\\auth.json",
      "/Users/*/.local/share/opencode/mcp-auth.json", "?:\\Users\\*\\.local\\share\\opencode\\mcp-auth.json",
      "/Users/*/.local/share/amp/secrets.json", "?:\\Users\\*\\.local\\share\\amp\\secrets.json",
      "/Users/*/.augment/session.json", "?:\\Users\\*\\.augment\\session.json",
      "/Users/*/.kimi/credentials/kimi-code.json", "?:\\Users\\*\\.kimi\\credentials\\kimi-code.json",
      "/Users/*/.cursor/auth.json", "?:\\Users\\*\\.cursor\\auth.json",
      "/Users/*/.pi/agent/auth.json", "?:\\Users\\*\\.pi\\agent\\auth.json",
      "/Users/*/.config/goose/secrets.yaml", "?:\\Users\\*\\AppData\\Roaming\\Block\\goose\\config\\secrets.yaml",
      "/Users/*/.config/muse/auth.json", "?:\\Users\\*\\.config\\muse\\auth.json",
      "/Users/*/.local/share/devin/credentials.toml", "?:\\Users\\*\\AppData\\Roaming\\devin\\credentials.toml",
      "/Users/*/.openclaw/credentials/oauth.json", "?:\\Users\\*\\.openclaw\\credentials\\oauth.json",
      "/Users/*/.openclaw/agents/*/agent/auth-profiles.json", "?:\\Users\\*\\.openclaw\\agents\\*\\agent\\auth-profiles.json",
      "/Users/*/.openclaw/agents/*/agent/auth.json", "?:\\Users\\*\\.openclaw\\agents\\*\\agent\\auth.json"
    ) and

    /* SSH public keys are not secrets and are routinely read by SSH and cloud tooling */
    not file.path like~ "*.pub" and

    /* Package ecosystem runtimes or binaries executing from package install locations */
    (
      process.name like~ ("python*", "node", "node.exe", "nodejs", "bun", "bun.exe", "deno", "deno.exe", "ruby*", "php*", "perl*") or
      process.executable like~ ("*/site-packages/*", "*/dist-packages/*", "*/node_modules/*", "*\\site-packages\\*", "*\\node_modules\\*",
                                "*/.venv/*", "*/venv/*", "*\\.venv\\*", "*\\venv\\*")
    )
  ]
  [network where
    cidrmatch(destination.ip, "169.254.169.254/32", "169.254.170.2/32", "169.254.170.23/32", "100.100.100.200/32", "fd00:ec2::254/128", "fd00:ec2::23/128") and
    destination.port == 80 and event.action == "connection_attempted" and host.os.type in ("macos", "windows")
  ]