Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials

Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials Ravie LakshmananMay 19, 2026Software Security / Malware In yet another software supply chain attack, threat actors have compromised the popular GitHub Actions workflow, actions-cool/issues-helper, to run malicious code that harvests sensitive credentials and exfiltrates them to an attacker-controlled server. "Every existing tag in the repository has been moved to point to an imposter commit that does not appear in the action's normal commit history," StepSecurity researcher Varun Sharma said. "That commit contains malicious code that exfiltrates credentials from CI/CD pipelines that run the action." An imposter commit refers to a deceptive software supply chain attack strategy in which malicious code is injected into a project by referencing a commit or tag that exists only in an adversary-controlled fork, rather than the original trusted repository. As a result, attackers can bypass standard Pull Request (PR) reviews and achieve arbitrary code execution. The imposter commit, per the cybersecurity company, contains code that, upon being executed within a GitHub Actions runner, performs a series of actions - Downloads the Bun JavaScript runtime to the runner. Reads memory from the Runner.Worker process to extract credentials. Makes an outbound HTTPS call to an attacker-controlled domain ("t.m-kosche[.]com") to transmit the stolen data. StepSecurity said 15 tags associated with a second GitHub action, "actions-cool/maintain-one-comment" have also been compromised with the same functionality. GitHub has since disabled access to the repository due to a "violation of GitHub's terms of service." It's currently not known what led the Microsoft-owned subsidiary to this decision. Interestingly, the exfiltration domain "t.m-kosche[.]com" has been observed in the latest wave of the Mini Shai-Hulud campaign targeting npm packages from the @antv ecosystem, indicating the two clusters of activity could be related. In a statement shared with The Hacker News, Philipp Burckhardt, head of threat intelligence at Socket, said the @antv npm compromise is likely linked to the actions-cool hack, citing overlaps in the exfiltration domain. "That points to the same Mini Shai-Hulud activity cluster, not a separate npm-only incident," Burckhardt added. "We're still being careful about the exact initial access path, but the overlap is strong enough that we're treating them as related." "Because every tag now resolves to malicious commits, any workflow that references the action by version pulls the malicious code on its next run," StepSecurity said. "Only workflows pinned to a known-good full commit SHA are unaffected." (The story was updated after publication to include a response from Socket.) Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  CI/CD, Credential Theft, cybersecurity, GitHub Actions, Malware, Mini Sha-Hulud, NPM, Software Security, StepSecurity, Supply Chain Attack ⚡ Top Stories This Week ThreatsDay Bulletin: PAN-OS RCE, Mythos cURL Bug, AI Tokenizer Attacks, and 10+ Stories Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation ⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers and More Four OpenClaw Flaws Enable Data Theft, Privilege Escalation, and Persistence Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI and More Packages [Webinar] How Modern Attack Paths Cross Code, Pipelines, and Cloud New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution 18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor Load More ▼ ⭐ Featured Resources Identify Internal Attack Surfaces More Efficiently With a Free Assessment [Guide] Stop Email Fraud Before It Turns Into Ransomware Damage [eBook] Get the 3-Number SOC Diagnostic to Reduce Queue Risk [Webinar] Learn How to Handle Critical SOC Alerts With AI Support