FlagThis

Abstract

This research proposes the development of an Endpoint Detection and Response (EDR) system for GitHub by leveraging the platform's own event streams. By analyzing webhooks, APIs, and git internals, the authors identify and detect common supply chain attack TTPs—such as artifact poisoning, identity forgery, and OIDC abuse—that are frequently used to compromise package registries and CI/CD pipelines.