Researchers Detect Malicious npm Package Targeting GitHub-Owned Repositories

Cybersecurity researchers have uncovered a malicious npm package named "@acitons/artifact" that typosquats the legitimate "@actions/artifact" package with the aim of targeting GitHub-owned repositories. Veracode says the package series comprises six versions from 4.0.12 to 4.0.17 that include a post-install hook to download and run malware; the latest available version on npm is 4.0.10, suggesting the threat actor behind the package, blakesdev, has removed the offending versions.

The package was first uploaded on 29 October 2025 and has amassed 31,398 weekly downloads and a total of 47,405 downloads, according to npm-stat data; Veracode also identified another npm package named "8jfiesaf83" with similar functionality, which has been downloaded 1,016 times.

A postinstall script downloads a binary named "harness" from a now-removed GitHub account, where the binary is an obfuscated shell script that checks the date and prevents execution after 2025-11-06 UTC, and it runs a JavaScript file named "verify.js" to exfiltrate data in encrypted form to a text file hosted on the app.github[.]dev subdomain.

The researchers note the malware was designed to target repositories owned by the GitHub organisation, including a user account with no public activity, signalling a targeted approach towards GitHub. According to Veracode, the activity underscores the risk to GitHub-owned workflows and tokens exposed in build environments.