GitHub Actions release workflow tampered to enable unattended npm publish

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•4

Detects malicious tampering with GitHub Actions workflows by monitoring for two specific patterns within an hour: the addition of automatic push triggers for the main branch alongside the removal of manual approval gates, or rapid sequential commits that rewrite workflows to facilitate an unattended publish of a package. This rule also integrates with npm registry publish events to identify potential malicious distribution of compromised packages like @dforge-core/dforge-mcp.