A supply chain attack has compromised the GitHub Actions workflow actions-cool/issues-helper, with malicious commits used to harvest credentials from CI/CD runners and send them to an attacker-controlled server, according to a technical analysis by StepSecurity.
KEY FACTS
- Compromise Every existing tag in the repository now points to an imposter commit.
- Payload The malicious code downloads Bun, reads memory from the Runner.Worker process, and exfiltrates credentials.
- Second action Fifteen tags tied to actions-cool/maintain-one-comment were also altered with the same behavior.
- GitHub response Access to the maintain-one-comment repository has been disabled for a terms of service violation.
The report said the imposter commit sits outside the action’s normal commit history and is designed to run malicious code when a workflow references the action by version. That approach can bypass standard pull request reviews and let attackers execute code inside GitHub Actions runners.
According to the disclosure, the code makes an outbound HTTPS request to the domain t.m-kosche[.]com after collecting data from the runner process. StepSecurity said workflows pinned to a known-good full commit SHA are not affected, while version-based references can pull the malicious code on the next run.
The same domain has also appeared in the Mini Shai-Hulud campaign targeting npm packages from the @antv ecosystem, which suggests the activity could be linked. The cause of GitHub’s repository restriction was not disclosed.
WHY IT MATTERS
The incident shows how a trusted automation component can be turned into a credential theft tool if tags are moved to malicious commits. Projects that pin GitHub Actions to full commit SHAs reduce exposure, while version-based references can inherit the compromise on the next workflow run.