CVE-2026-48368

creationtimestamp| type| source ---|---|--- 2026-07-15 14:46:46+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqoxmbo6ad2z...

Npm Package Targeting GitHub-Owned Repositories Flagged as Red Team Exercise

Cybersecurity researchers have discovered a malicious npm package named "@acitons/artifact" that typosquats the legitimate "@actions/artifact" package with the intent to target GitHub-owned repositories. "We think the intent was to have this script execute during a build of a GitHub-owned...