Miasma OIDC Trusted Publishing Abuse - npm publish from GitHub Actions Runner

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects instances where a GitHub Actions runner requests an OIDC token and subsequently executes an npm publish command within 5 minutes. This behavior is indicative of unauthorized package deployment, potentially exploiting GitHub's OIDC 'trusted publishing' mechanism, as observed in the Miasma worm campaign.