Miasma Exfiltration via GitHub API with OIDC Trusted Publishing to stitch-production.org

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•3

Detects outbound network connections to 'stitch-production.org' or connections by node/bun runtime processes to GitHub API or 'stitch-production.org', which may indicate command and control communication or data exfiltration.