GitHub already has an EDR. You just have to listen to it
Summary
Researchers presented at Black Hat USA 2026 on a new approach to detecting supply-chain attacks by analyzing GitHub's event stream. They argued that GitHub provides sufficient telemetry to identify malicious activity, and developed an open-source tool called "GitHub Threat Detector" with various detection rules.
IFF Assessment
This article discusses a new defensive tool and approach that helps security professionals detect threats within their development environments, making it good news for defenders.
Defender Context
This research highlights that valuable security telemetry is often available within development platforms like GitHub, which defenders might overlook. By analyzing event streams and looking for specific behavioral patterns associated with common attack techniques, organizations can potentially detect supply-chain compromises earlier.