Miasma Worm Weaponized GitHub Actions Workflow with OIDC npm Publishing

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects malicious GitHub Actions workflow activity characteristic of the Miasma worm. The rule monitors for the creation or update of workflows named 'Dependabot Updates' (masquerading), which utilize OIDC token write permissions and execute scripts using 'bun run _index.js', often on suspicious snapshot branches.