Malicious npm Package @acitons/artifact Targets GitHub Repositories
Cybersecurity researchers have identified a malicious npm package named @acitons/artifact, which closely resembles the legitimate @actions/artifact package. This deceptive package appears to be designed to infiltrate GitHub-owned repositories.
The primary objective of this package is to execute scripts during the build processes of GitHub repositories. By doing so, it aims to extract tokens from the build environment and potentially use these tokens to publish unauthorized artifacts under GitHub’s name.
Veracode’s analysis revealed that versions 4.0.12 to 4.0.17 of @acitons/artifact included a post-installation hook that downloads and executes malicious code. Interestingly, the latest available version on npm is 4.0.10, suggesting that the creator, known as blakesdev, may have removed the compromised versions.
First uploaded on October 29, 2025, the package has accumulated 31,398 weekly downloads, totaling 47,405 downloads. Another package, 8jfiesaf83, exhibiting similar behavior, was also identified but is no longer available.
Further investigation into the malicious versions revealed a post-installation script designed to download a binary named harness from a now-deleted GitHub account. This obfuscated shell script includes a time check to prevent execution after November 6, 2025, UTC.
The script also runs a JavaScript file, verify.js, which searches for specific GITHUB_ variables set during GitHub Actions workflows. The collected data is then encrypted and sent to a text file hosted on the app.github[.]dev subdomain.
Veracode noted that the malware specifically targets repositories owned by GitHub, indicating a focused attack against the platform. The campaign also appears to target a user account y8793hfiuashfjksdhfjsk, which exists but shows no public activity, suggesting it might be a test account.
