Miasma 'Run Copilot' GitHub Actions Workflow Drops to Exfiltrate CI/CD Secrets

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

This rule detects the execution of Node.js or Bun JavaScript runtime processes with command-line arguments often associated with CI/CD automation, dependency updates, or potential obfuscated script execution patterns.