MALICIOUS NPM PACKAGE SNEAKS INTO GITHUB ACTIONS BUILDS

Summary from the TLDR InfoSec newsletter

A typosquatted npm package named "@acitons/artifact," with 260K downloads, targeted GitHub Actions CI/CD pipelines through a post-install hook that ran obfuscated shell scripts to steal tokens and impersonate GitHub by publishing malicious artifacts.