Harnessing GitHub Telemetry for Enhanced Security Detection

Recent incidents of supply-chain attacks could have been detected much earlier if organizations had tapped into the telemetry that GitHub offers, per insights from industry experts. At Black Hat USA 2026, Yossi Weizman from Microsoft and Mor Weinberger from Echo advocated for an approach that takes advantage of GitHub’s own event stream instead of leaning solely on traditional endpoint or network monitoring systems. They proclaimed, “GitHub can tell you’re being hacked. You’re just not listening.” This assertion raises significant questions about why businesses aren’t prioritizing such readily available information.

Patterns in Supply-Chain Attacks

In their presentation, the researchers analyzed patterns from notable supply-chain incidents such as Shai-Hulud, Trivy, and Megalodon. A common thread among these attacks was the use of similar techniques, including forged commit identities, poisoned tags, workflow manipulation, theft of OpenID Connect (OIDC) tokens, and attempts to erase traces of attacks. By converting these identifiable patterns into behavioral detections, they integrated GitHub webhooks, API data, and repository insights to construct a historical activity overview. The repetitive nature of these attacks indicates a systemic vulnerability focused on identity—both authentic and forged.

The Evidence Within GitHub

The crux of Weizman and Weinberger’s investigation revealed that supply-chain attacks often repeat specific patterns, regardless of the projects compromised. Disguised identities can make malicious commits seem legitimate; metadata like author names and timestamps can be manipulated. However, GitHub tracks the authorized user who submits the commit, offering defenders a basis for investigation when discrepancies arise between the commit author and the authenticated user. This oversight provides an untapped resource that security teams typically overlook.

Furthermore, they highlighted the unique opportunity to connect seemingly unrelated incidents by identifying reused forged identities. By searching for identical author emails across multiple repositories, defenders can glean insights into broader attack patterns. “Forged identities in the repo that appear in other repos as well are a strong indication of compromise,” they said. The implications here are glaring—if security teams can harness GitHub’s logging capabilities effectively, they may spot threats that otherwise go unnoticed until it’s too late.

The researchers tracked the misuse of “forged maintainer identities” across incidents such as Trivy, tj-actions, and Megalodon, showcasing the effectiveness of monitoring these identities. They proposed additional detection mechanisms like tracking instances of massive tag poisoning, where adversaries force multiple release tags on a malicious commit, leading to the execution of compromised code within workflows. They recommended employing GitHub’s API to monitor tag history and compare commit references to expose such tactics—a method that, if properly implemented, could drastically reduce the window of vulnerability.

Enhancing Detection through Correlation

The GitHub Threat Detector operates on a principle similar to endpoint detection and response (EDR) systems: it gathers activity, enriches data with contextual information, flags anomalous behaviors, and supports investigation or response efforts. The array of signals processed includes live GitHub webhooks, API events, commits, tags, and Actions activity, supplemented by Git inspection results that reveal the origin of tags. This multi-faceted approach amplifies the chances of timely threat detection.

A PostgreSQL-backed activity store underpins the tool’s functionality, maintaining necessary historical records to correlate events effectively over time. During development, over 30 detection rules were tested against 52 simulated attacks, replicating incidents involving Trivy, TanStack, and others to ensure its reliability. As part of this process, a dedicated “noise lab” facilitated measurements of detection performance and effectiveness, while refining detection rules via allowlisting and severity tuning. Yet, in the attempt to sharpen accuracy, there’s a risk of overlooking genuine anomalies—subtleties can easily get lost in the noise.

Limitations and Opportunities

Despite its potential, the system is not without limitations. Challenges include inactive webhooks, API rate limits, and the non-real-time nature of Git inspection, which may impede immediate response capabilities. These factors can significantly reduce the efficacy of rapid threat analysis, making it vital for organizations to prepare contingency plans. It's a balancing act: while the tool can enhance detection, teams still need traditional defensive measures as part of a broader strategy. (And this is the part most people overlook.)

Implications for the Future

If you’re working in this space, the implications are clear: traditional security measures are simply insufficient against modern threats. The insights from GitHub’s telemetry could change the way organizations view their own security postures. Detection might shift from a reactive to a more proactive approach, using patterns observed within GitHub to anticipate attacks before they happen. This would require not only an investment in technology but also a cultural shift in how organizations regard their own security practices.

What this means for you is straightforward: understanding and monitoring these emerging detection strategies may look like a shift in resource allocation or personnel training. Companies willing to adapt and adopt these tactics may find themselves ahead of the threat curve. Those that don’t may find themselves reacting to the next major supply-chain incident as they always have—unprepared and vulnerable.