Anomalous push-then-publish activity on @dforge-core/dforge-mcp main branch

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•1

Detects anomalous activity in GitHub repositories where a code push by an actor is followed by an NPM package publish event from the same actor within a 105-minute window. This behavioral pattern is indicative of a potential compromised maintainer session or malicious code injection into the software supply chain.