IronWorm Backdated Git Commits with claude Bot Identity Spoofing

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects suspicious git commit activity associated with the IronWorm campaign. The rule monitors for git operations involving backdated commits or force-pushes, particularly those using a specific noreply email address or common maintenance commit messages, which are indicative of supply-chain compromise and timestomping techniques within npm repositories.