IronWorm GitHub Repository Defacement via Compromised Developer Credentials

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects suspicious repository content updates, such as modifications to package files, workflow configurations, or README files, and activities involving automated user IDs like 'dependabot' or 'github-actions' that may indicate compromised CI/CD credentials or unauthorized repository defacement.