The GitHub Actions supply-chain attack against actions-cool/issues-helper is a serious reminder that CI/CD pipelines are now prime targets for credential theft. In this case, attackers reportedly moved existing GitHub Action tags to point to an imposter commit containing malicious code, causing workflows that referenced those tags to execute credential-stealing logic during pipeline runs. The malicious code attempted to extract secrets from the GitHub Actions runner and exfiltrate them to an attacker-controlled domain.

Organizations should immediately review workflows using actions-cool/issues-helper or actions-cool/maintain-one-comment, rotate exposed CI/CD secrets, audit recent pipeline runs, and avoid relying only on version tags for third-party Actions. Pinning GitHub Actions to known-good full commit SHAs, enforcing least-privilege tokens, limiting workflow secrets, and monitoring outbound runner activity should become standard practice. CI/CD systems are no longer just automation helpers; they are high-value execution environments with access to source code, deployment keys, cloud credentials, and production workflows. Attackers have clearly realized that compromising the pipeline is often easier than attacking the finished product, because why break into the house when the builder left the master key in the toolbox.

In yet another software supply chain attack, threat actors have compromised the popular GitHub Actions workflow, actions-cool/issues-helper, to run malicious code that harvests sensitive credentials and exfiltrates them to an attacker-controlled server. "Every existing tag in the repository has been moved to point to an imposter commit that does not appear in the action's normal commit history,

Source: GitHub Actions Supply Chain Attack Redirects Tags to Steal CI/CD Credentials via The Hacker News — published 19 May 2026.