Miasma Fake Dependabot GitHub Actions Workflow with Suspicious Payload Patterns

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•3

Detects the creation of GitHub Actions workflow files within the .github/workflows/ directory that mimic Dependabot naming conventions while containing suspicious indicators associated with the Miasma/Mini Shai-Hulud supply chain attack. Indicators include hardcoded secret references, specific operational markers like 'RevokeAndItGoesKaboom', and unauthorized OIDC token permissions.