Miasma Worm: GitHub Actions runner secret access followed by non-GitHub outbound connection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•6

Detects GitHub Actions runner processes (e.g., node, bash, python) accessing sensitive CI/CD environment variables (GITHUB_TOKEN, NPM_TOKEN) followed within 30 seconds by an outbound network connection to a non-GitHub domain. This pattern is indicative of potential secret exfiltration by compromised CI/CD pipelines or malicious build steps.