GitHub Action Vulnerability Exposes Workflow Credentials

Key Takeaways

• A supply chain attack compromised two popular GitHub Actions: actions-cool/issues-helper and actions-cool/maintain-one-comment.
• Attackers silently redirected all version tags to malicious commits, enabling credential exfiltration from CI/CD pipelines.
• Any workflow referencing these actions by a version tag is vulnerable to pulling and executing the malicious code.
• The attack was identified by StepSecurity on May 18, 2026, and a detailed analysis has been published.
• Immediate action, including pinning workflows to specific commit hashes and rotating secrets, is crucial for affected users.

A significant supply chain attack has been uncovered, impacting two widely utilized GitHub Actions: actions-cool/issues-helper and actions-cool/maintain-one-comment. The compromise involved the silent redirection of every version tag within their respective repositories to unauthorized, malicious commits. This sophisticated maneuver allowed attackers to steal sensitive CI/CD pipeline credentials, posing a severe risk to development teams globally that integrate these actions into their automated workflows. A comprehensive security analysis details the mechanics of this attack.

The method of compromise was deceptively straightforward. An attacker managed to gain control over tag manipulation within the repositories, subsequently re-pointing all 53 existing version tags for actions-cool/issues-helper and all 15 for actions-cool/maintain-one-comment to imposter commits. These malicious commits were not part of the repositories’ legitimate code history.

Consequently, any development team whose workflow specified these actions using a version tag would inadvertently download and execute the rogue code during subsequent pipeline runs. Only workflows explicitly pinned to a specific, verified commit hash remained immune to this manipulation.

Discovery and Attack Vector

Security researchers at StepSecurity brought this attack to light, publishing an in-depth report on May 18, 2026. The report, shared with Cyber Security News (CSN), explained that the malicious commit leveraged the open-source Bun JavaScript runtime. This runtime was used to execute a payload designed to read directly from the memory of the Runner.Worker process. This particular component within GitHub’s pipeline infrastructure is responsible for holding decrypted workflow secrets during a job’s execution.

The speed and precision of the attack were notable. All 53 imposter commits for issues-helper were created within a mere three minutes and sixteen seconds, while the 15 commits for maintain-one-comment were generated in less than forty seconds. Stolen data was consistently directed to the same attacker-controlled domain, t.m-kosche.com.

This incident underscores a growing trend in supply chain attacks targeting developer tools. Adversaries are increasingly focusing on high-leverage entry points that can compromise numerous organizations through a single, poisoned dependency. CI/CD pipelines have become a prime target due to their frequent storage of powerful credentials for cloud services, code repositories, and deployment systems.

How the Attack Harvests Secrets

Upon execution within a GitHub Actions pipeline, the malicious commit initiated a carefully orchestrated sequence of steps. The payload first downloaded the Bun JavaScript runtime into the runner environment. Subsequently, it spawned a Python process tasked with reading the memory address space of the Runner.Worker process, specifically targeting the /proc//mem path. This path is where GitHub Actions temporarily stores decrypted workflow secrets while a job is active.

The payload then employed standard Unix utilities to filter this memory dump, specifically extracting values flagged with the internal attribute “isSecret”:true. Following this, it retrieved the GitHub authentication token and escalated privileges using sudo python3. Finally, the collected credentials were exfiltrated over an outbound HTTPS connection on port 443 to the attacker’s domain, t.m-kosche.com. Interestingly, GitHub’s own repository interface flagged the imposter commit 1c9e803 with a warning indicating it did not belong to any branch, yet it remained accessible via the manipulated tags.

Detection and Recommended Steps

StepSecurity’s Harden-Runner tool successfully detected this attack in real-time. It flagged several anomalous activities: the unauthorized download of the Bun runtime, the suspicious memory read process, and the unexpected outbound network connection to t.m-kosche.com. Workflows protected by Harden-Runner had the attacker’s domain automatically blocked at the network level, preventing credentials from leaving the runner even if the malicious code fully executed. While the attacker attempted to mask their activity with fake commit messages designed to mimic legitimate release notes, the tightly clustered creation timestamps immediately exposed the fraudulent nature of the commits.

What You Should Do

• Pin Workflows to Specific Commit SHAs: Immediately modify all GitHub Actions workflows that utilize actions-cool/issues-helper or actions-cool/maintain-one-comment to reference a full, verified commit SHA instead of a floating version tag. This prevents silent redirection to malicious code.
• Audit Recent Workflow Runs: Conduct a thorough audit of all recent workflow runs that referenced either actions-cool/issues-helper or actions-cool/maintain-one-comment.
• Rotate All Compromised Secrets: Treat any tokens or secrets potentially exposed during these runs as fully compromised. The most urgent and critical step is to rotate all pipeline secrets, including GitHub tokens, cloud provider credentials, and any other sensitive information used by these workflows.
• Monitor for Outbound Traffic: Review CI/CD logs for any outbound traffic to the domain t.m-kosche.com. The presence of such traffic is a definitive indicator of credential theft.
• Implement Enhanced Runner Security: Consider deploying tools like StepSecurity’s Harden-Runner to detect and prevent similar supply chain attacks by monitoring for suspicious activities like unauthorized software downloads, memory access, and unexpected network connections.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.