ArtiPACKED: Hacking Giants Through a Race Condition in GitHub Actions Artifacts

This report from Palo Alto Networks details research showing that GitHub Actions build artifacts can unintentionally contain sensitive tokens (GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN), which attackers can extract—within token expiration windows—to push unauthorized code, replace artifacts (enabling remote code execution), or access cloud/GitHub secrets; the author automated discovery across popular public projects, demonstrated PoC exploitation against multiple high-profile repositories, reported findings to maintainers, and provided mitigation guidance including a secure artifact upload action.