Rapid dual GitHub Actions workflow tampering enabling auto-publish on push

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•1

Detects multiple rapid modifications to GitHub Actions workflow files (.github/workflows/*.yaml) within a short timeframe (<= 20 minutes). This pattern is indicative of potential CI/CD pipeline poisoning or suspicious activity where an actor may be attempting to inject malicious code or configurations into the build process.