Miasma Worm Weaponized GitHub Actions Workflow CI/CD Propagation

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects the Miasma worm propagating through CI/CD pipelines by identifying unauthorized updates to GitHub Actions workflow files. Specifically monitors for modifications to workflows under the LeoPlatform or LeoInsights projects by the compromised user 'czirker', with signs of weaponization such as the addition of OIDC id-token write permissions and npm-publish capabilities.