After finding out current supply-chain assaults, together with Shai-Hulud, Trivy, and Megalodon, the researchers discovered that seemingly totally different incidents repeatedly used the identical methods, from solid commit identities and poisoned tags to workflow abuse, OpenID Join (OIDC) theft, and makes an attempt to erase proof.
They mentioned they turned these recurring methods into behavioral detections, combining GitHub webhooks, API information, and Git repository inspection to construct a historic view of exercise.
Their new open-source instrument, dubbed “GitHub Menace Detector,” reportedly contains 22 manufacturing detection guidelines and 12 beta guidelines, with compound detections designed to correlate individually weaker indicators into high-confidence alerts.
