Detects a runtime (Python, Node.js, Bun, Deno, Ruby, PHP, or Perl) or a binary executing from a package install location that opens a developer secret (SSH keys, registry tokens, source-control credentials or AI coding assistant credentials) and within one minute connects to a cloud instance metadata service (IMDS) endpoint. The rule correlates two behaviors from the same process: opening a local secret store that cloud SDKs never read, and then issuing a connection to IMDS endpoints (e.g., 169.254.169.254) to obtain cloud credentials. This pattern matches credential stealers delivered via compromised packages (e.g., LiteLLM) and excludes legitimate cloud SDK credential files to reduce false positives. It requires Elastic Defend data (file open events on macOS/Windows and associated network events) and a configured set of secret paths. The detection is implemented as a sequence by process.entity_id within 1 minute, constrained to secret file paths and package-runtime locations (site-packages, node_modules, virtual environments). False positives include legitimate release/build scripts on cloud agents that read tokens and then fetch instance credentials, or AI coding assistants reading their own credentials before contacting IMDS. Remediation includes isolating the host, rotating all secrets touched, revoking instance role sessions, removing the malicious package, locking down environment mirrors, and enforcing IMDSv2 with least privilege for instance roles. Severity is high and the rule maps to MITRE ATT&CK techniques for Unsecured Credentials (T1552.001, T1552.004, T1552.005) and Initial Access / Supply Chain contexts, with MITRE ATLAS mappings to AI Supply Chain Compromise and Credential Access.