Code pushed to a new git host
Code is pushed to a URL on a git host the machine has never reached before.
Why it is risky
Section titled “Why it is risky”Pushing a repository to a git host never used before can copy a codebase to a place its owner does not control.
Example
Section titled “Example”An agent runs a git push to a repository URL on an unfamiliar git host.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”This advanced rule fires when a command runs git push to a URL whose host no call from this machine had reached before. A push to a remote the project already names, such as origin, is not flagged, because the command names no host.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_ADV_CODE_PUSHED_TO_NEW_HOST | data_movement | Requires Pro | MEDIUM |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Check the remote and whether the push was requested. If the host is unfamiliar, check what was pushed and whether the repository should be there.
False positives
Section titled “False positives”Creating a new repository on a legitimate new host, or the first push from a fresh machine, will match once.
False negatives
Section titled “False negatives”Pushes to named remotes, remotes configured to point somewhere new, and other ways of copying code are not covered by this rule.
Technical details
Section titled “Technical details”The rule reads the command, not the repository, so it cannot say what was pushed. This advanced rule produces evidence with the finding: each call in the chain with its role, a one-line summary of what it did, where the last call went, and why the chain might be routine. In the hosted dashboard, related findings about the same chain are read together as one investigation. Availability depends on the advanced rule bundle loaded by the installation. Findings on activity captured by agent hooks appear when the session ends or at the next background pass, within about 15 minutes; activity through the MCP proxy is judged as it is recorded.
A finding describes a pattern in captured activity. Review the original calls, their results, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.