npm publish immediately following workflow tampering (0.2.21 pattern)

Ibrahim Saud@tektrix

•updated 15 days ago•1•0•4

Detects instances where a repository's GitHub CI/CD workflow, git configuration, or repository settings are modified, followed shortly thereafter by an npm package publish event. This behavior is indicative of a supply chain compromise where an adversary modifies workflow files to auto-publish malicious versions of a package.