Shai Hulud Github Actions Workflow Injection

Tim Peck@timpeck

•updated Sep 25, 2025•3•0•244

Detects the creation or modification of a GitHub Actions workflow file that attempts to exfiltrate secrets. This pattern is associated with the Shai-Hulud worm, which injects malicious workflows to steal credentials using `toJSON(secrets)` and exfiltrate them using tools like `curl` and `base64`.