Suspicious Sudoers Modification at /mnt/runner

Ethan Andrews@eandrews

•updated Jun 2, 2026•5•0•11

Detects file write operations to '/mnt/runner' indicating a sudoers configuration modification. This technique is utilized by the Miasma npm malware to grant passwordless sudo access for privilege escalation on GitHub Actions CI/CD runners.