IronWorm Supply-Chain Trojanization via Backdated GitHub Commits

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule monitors GitHub repository activity (git.push, git.clone, repo.contents) to identify specific activity patterns associated with known GitHub usernames, email addresses, or specific repository paths (e.g., tools/setup, .github/scripts/precheck) and commit messages. It flags potentially significant actions such as forced pushes to default branches for review.