How to Prevent gh CLI from Leaving a Plaintext Token on WSL2

On WSL2 without a working keyring, gh auth login falls back to storing the token in plaintext at ~/.config/gh/hosts.yml . Worse, the OAuth token GitHub CLI issues . covers this problem well. This isn&rsquo;t a theoretical risk. gh auth token shows up repeatedly as a credential-harvesting step in real npm supply chain attacks. Palo Alto Networks&rsquo; Unit 42 in the Mini Shai-Hulud campaign, where…