Sckit CI Pipeline BASH_ENV Injection via GITHUB_ENV to Steal npm Tokens
Detects evidence of the SCKit supply chain worm within GitHub Actions CI pipelines. The rule identifies attempts to poison the build process by injecting a BASH_ENV path into GITHUB_ENV, which forces the execution of a malicious script (sckit-publish-bridge.sh) during subsequent shell steps. This script is designed to exfiltrate npm publishing credentials (NODE_AUTH_TOKEN) to external infrastructure. The detection logic covers both the injection mechanism and diagnostic output indicators from the bridge script.
Sigma
