Miasma Worm - GitHub Actions Workflow id-token:write OIDC npm Publish Abuse

Ethan Andrews@eandrews

•updated Jun 25, 2026•0•0•1

Detects GitHub Actions workflow files that include 'id-token: write' permissions in conjunction with 'npm publish' or 'yarn publish' commands. This pattern is indicative of the Miasma worm (also known as the wshu.net campaign) which abuses OIDC trusted publishing to facilitate unauthorized npm package propagation. The rule also identifies workflows that attempt to fallback on legacy NPM_TOKEN secrets.