Miasma 'Run Copilot' GitHub Actions Workflow Injecting CI/CD Secret Exfiltration

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

This rule detects suspicious process execution patterns associated with malicious activities in GitHub Actions environments, specifically flagging the use of JavaScript runtimes (node, bun) to execute malicious payloads, git operations related to pull request data exfiltration (pwn-request), and the creation of orphan branches characteristic of the Miasma campaign.