Skip to content

Secret Exfiltration Attempt detection

Named by 2 kept items in this workspace.

Search every workspace for Secret Exfiltration Attempt detection. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials
    writeup2026-07-25It is written here as Secret Exfiltration Attempt detection (StepSecurity Harden-Runner).

    Flags CI runs that read secrets and send them to outside endpoints, raising confidence when the workflow, branch, or file is deleted afterward.

  • Introducing Secret Exfiltration Protection for GitHub Actions
    article2026-07-16It is written here as Secret Exfiltration Attempt detection (Harden-Runner Detections page).

    flags workflow runs matching known attack patterns (workflow name, toJSON(secrets) pattern, commit message pattern, exfil artifact name); lists affected repository, matched rule, confidence, indicators, workflow file, and exact job/step/line

All technologies in this workspace.