Researchers have identified critical security vulnerabilities in GitHub Actions, where a newly discovered attack vector, tracked as “ArtiPACKED”, and other associated risks could jeopardize the integrity of numerous high-profile open-source projects from major companies like Google, Microsoft, AWS, Red Hat, and others. These projects were found to be leaking GitHub authentication tokens, such as “GITHUB_TOKEN” and “ACTIONS_RUNTIME_TOKEN”, through CI/CD workflows due to a combination of insecure default settings, user misconfigurations, and inadequate security checks. The leaks present a severe threat, as attackers with access to these tokens could gain unauthorized entry to private repositories, manipulate or inject malicious code into the repository, and even infiltrate cloud environments. The vulnerability is exacerbated by the exposure of an undocumented environment variable which could allow attackers to substitute legitimate artifacts with malicious versions, potentially leading to remote code execution (RCE). This exploitation is possible by using race condition scenarios to steal and use tokens. GitHub has categorized the issue as informational and has not implemented a direct fix, instead placing the responsibility on users to secure their artifacts. This has prompted cybersecurity experts to stress the importance of organizations and developers reevaluating their CI/CD pipeline configurations, avoiding the inclusion of entire directories in artifacts, sanitizing logs, and setting token permissions to the least privilege necessary. These measures are essential to mitigate the risks and prevent future token leaks that could lead to severe security breaches.