GitHub Threat Detector Launches With 22 Rules to Flag Supply-Chain Attacks
Updated
Updated · InfoWorld · Aug 11
GitHub Threat Detector Launches With 22 Rules to Flag Supply-Chain Attacks
3 articles · Updated · InfoWorld · Aug 11
Summary
An open-source GitHub Threat Detector debuted at Black Hat USA 2026 with 22 production rules and 12 beta rules built to spot software supply-chain attacks from GitHub’s own telemetry.
Researchers said the tool uses an EDR-style pipeline—webhooks, API events, commits, tags and Actions activity—to turn recurring attacker behavior into detections instead of relying only on endpoint or network logs.
Key signals include mismatches between forged commit authors and authenticated pushers, reused fake maintainer identities across repositories, mass tag poisoning, and workflow changes that enable OIDC token issuance.
More than 30 rules were tested in 52 attack simulations, including recreations of Trivy, TanStack, Megalodon and Bitwarden CLI incidents, with compound detections correlating weaker signals into higher-confidence alerts.
The approach still faces practical limits: webhooks may be disabled, APIs can be rate-limited, and Git inspection is not real-time, underscoring that GitHub evidence is useful but imperfect.