This article has been updated with new details and a comment from GitHub.
A recent Veracode blog post describing npm packages that appeared to target GitHub credentials has now been clarified by GitHub as an internal Red Team exercise, not a live attack.
The packages, which initially raised concerns among security researchers for collecting GitHub Actions tokens, were part of GitHub’s controlled testing to improve its detection and response systems.
Cybersecurity researchers at Veracode discovered a campaign that was aimed at stealing critical credentials from GitHub’s own code base. The attack involved hackers planting a fake software component on npm (Node Package Manager), which is a massive public library that developers use to share JavaScript code.
For your information, an npm package is a folder containing code, documentation, and metadata that developers can easily share and integrate into their projects. These help them build modern applications by reusing existing, tested code components instead of writing everything from scratch.
The Package
Cybersecurity firm Veracode’s threat research team flagged the malicious npm package, a GitHub Actions Toolkit named “@acitons/artifact", on Friday, November 7. This name is a clear example of how scammers use a trick called typosquatting to deceive unsuspecting users.
This type of attack involves registering a name that intentionally looks like a typo of a legitimate one (the real package is @actions/artifact), hoping developers will accidentally download the wrong one. The malicious package was surprisingly popular, having been downloaded over 206,000 times.
How the Supply Chain Was Compromised
This type of breach, technically called a Software Supply Chain Failure, has become a major concern, even making it onto the OWASP TOP 10 2025 (RC1) list of top risks, researchers noted in the blog post shared with Hackread.com.
The fake code package was set up to launch a dangerous sequence immediately after installation. It contained a post-install hook (basically a special script) that would download and run malware to steal GitHub tokens.
Think of these tokens as temporary access keys for the code environment. Veracode’s researchers believe the ultimate motivation was to “exfiltrate the tokens available to the build environment, and then use those tokens to publish new malicious artifacts as GitHub.”
Further investigation showed the malware was extremely focused. It was programmed to check whose repository it was in, and specifically targeted repositories owned by the GitHub organisation. A check within the harmful code ensured it would “exit if the organisation was not GitHub,” confirming the attackers were aiming at the core platform.
Package Removal Timeline
It is worth noting that when the researchers first found the malware, even popular anti-virus software did not catch it. The attackers had also included an expiration date, setting the code to stop working after 2025-11-06 UTC. The research also identified and blocked another fake package called “8jfiesaf83“.
By Monday, November 10, the malicious versions of the package were taken down, likely by the attackers themselves or by GitHub.
Important Update – November 11, 2025:
GitHub has now confirmed to Hackread.com that the npm packages referenced in Veracode’s report were not part of a real malicious campaign but rather a controlled exercise conducted by GitHub’s internal Red Team. The activity was designed to evaluate internal detection and response capabilities. Veracode’s blog has since been updated to reflect this clarification.
Hackread.com has updated this article to include GitHub’s statement and to clarify that the packages were not created or used by external threat actors.
“The packages referenced in Veracode’s blog were part of a tightly controlled exercise conducted by GitHub’s Red Team. GitHub takes security seriously and regularly tests its security posture through rigorous, realistic Red Team exercises to ensure resilience against current threat actor techniques. At no point were GitHub systems or data at risk.”
A GitHub Spokesperson.
