GitHub Actions Workflow Compromised in Credential Theft Attack

In a recent software supply chain attack, a widely used GitHub Actions workflow, `actions-cool/issues-helper`, was exploited to steal CI/CD credentials. Threat actors employed an "imposter commit" technique, where all existing tags in the repository were manipulated to point to a malicious commit not present in the action's legitimate history. This allowed the attackers to bypass typical Pull Request (PR) reviews and execute arbitrary code within affected CI/CD pipelines. Upon execution within a GitHub Actions runner, the injected malicious code performed several critical steps. It downloaded the Bun JavaScript runtime, then proceeded to read memory from the `Runner.Worker` process to extract sensitive credentials. These stolen credentials were subsequently exfiltrated to an attacker-controlled domain, `t.m-kosche[.]com`. Further investigation revealed that a second GitHub action, `actions-cool/maintain-one-comment`, was also compromised with similar malicious functionality. GitHub responded by disabling access to the affected repositories due to violations of its terms of service. The exfiltration domain used in this attack has also been linked to the "Mini Shai-Hulud" campaign, which previously targeted npm packages, suggesting a potential connection between these activities. This incident underscores the ongoing security risks within the software supply chain, particularly concerning GitHub Actions. GitHub has acknowledged these systemic problems, outlining a security roadmap in March 2026 aimed at enhancing the platform's defenses. This roadmap focuses on implementing secure-by-default behaviors, such as deterministic dependency locking, network egress firewalls for runners, scoped secrets, and centralized policy enforcement. These initiatives aim to shift the burden of security from individual workflow authors to the platform itself, moving towards a model with less ambient trust and more infrastructure-level control over automation. In the interim, organizations are advised to follow best practices to mitigate risks, including pinning all third-party actions to a full commit SHA, setting default `GITHUB_TOKEN` permissions to read-only, avoiding `pull_request_target` in public repositories, and using OpenID Connect (OIDC) for cloud credentials instead of long-lived secrets. These measures help to close common attack vectors that attackers actively exploit.