IronWorm npm Trusted Publishing OIDC Token Exchange then Package Publish

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects anomalous activity consistent with the IronWorm threat actor using compromised CI credentials to perform npm package publishing. The rule identifies a sequence of two events from the same source IP within a 10-minute window: first, an OIDC identity token exchange request at the npm registry, followed by a package publish operation (PUT request). This behavior is characteristic of malicious actors hijacking CI/CD pipelines to inject malicious code into trusted npm packages.