Open Source · · 130 days

actions-cool GitHub Actions tags rewritten by TeamPCP

Attackers rewrote version tags for two actions-cool GitHub Actions to run secret-stealing code. GitHub disabled the repositories in May, but the same malicious tags became available again in September.

Part of Shai-Hulud hits npm and PyPI campaign

On May 18, 2026, attackers redirected version tags for actions-cool/issues-helper and actions-cool/maintain-one-comment to malicious commits. Consumers pinned to affected tags received the injected action on their next workflow run.

The injected step downloaded Bun and read the GitHub Actions Runner.Worker process memory to extract workflow secrets. It sent captured credentials to t.m-kosche.com. The operation overlapped with other compromises attributed to TeamPCP.

GitHub disabled both repositories. They became available again with the malicious tags on September 16, then were disabled again on September 25. The September activity renewed distribution of the May compromise; it does not establish a second initial intrusion.

Notes

  • The September reports describe downstream repositories receiving malicious editor hooks after workflows used the re-enabled action.
  • Exposure occurred in separate May and September windows; the start and end dates do not imply continuous availability.

Appendix · Affected releases

actions-cool/issues-helper github actions
  • All 53 version tags from v1.0.0 through v3.8.0 were re-pointed to the imposter commit. GitHub later disabled the repository.
  • The affected releases were recorded as a wildcard rather than enumerated, so this record asserts no version list.
  • The malicious tags became accessible again September 16–25 after an earlier repository suspension.
actions-cool/maintain-one-comment github actions
  • All 15 version tags were re-pointed to the distinct imposter commit 7f6120bb10c870b9fde146961a18e5bf0b3d4401. GitHub later disabled the repository.
  • The affected releases were recorded as a wildcard rather than enumerated, so this record asserts no version list.
  • The malicious tags became accessible again September 16–25 after an earlier repository suspension.

Indicators

References

  1. actions-cool/issues-helper GitHub Action Compromised - All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials - StepSecuritystepsecurity.io
  2. Compromised GitHub Action Exfiltrates Workflow Credentials - Cyber Security Newscybersecuritynews.com
  3. Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials - The Hacker Newsthehackernews.com
  4. TeamPCP: GitHub Action Scanning, Pinning, and Version Management - Puma Securitypumasecurity.io
  5. Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Huludsocket.dev
  6. September upstream reinfectionssafedep.io

Source record: oss/attacks/actions-cool/meta.yaml