Malicious npm Package with 206K Downloads Targeting GitHub Repositories to Steal Tokens

A malicious npm package named “@acitons/artifact” amassed over 206,000 downloads before being removed, in a campaign aimed at GitHub repositories to steal authentication tokens. The package impersonated the legitimate “@actions/artifact” package by swapping the letters “ti” for “it,” a classic typosquatting trick designed to catch developers mistyping dependency names.

Veracode Threat Research identified six malicious versions, each with a post-install hook that executed during installation and downloaded obfuscated malware that evaded detection by popular antivirus products, with the binary briefly flagged by zero vendors on VirusTotal. The attack chain involved an obfuscated shell script (compiled with shc), re-executed from bash and designed to extract and exfiltrate tokens from the build environment, with checks for GitHub Actions‑specific environment variables.

Exfiltration occurred via encrypted channels to a remote command‑and‑control server, and the actors intended to publish new malicious artefacts impersonating GitHub, potentially impacting downstream users and enabling a supply chain attack. Veracode notified npm of the malicious package, leading to its removal, and the report notes that two GitHub users involved in the operation have been removed.