---
title: "actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials"
url: https://daily.dev/posts/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltr-12ij52s4u
source_url: https://www.stepsecurity.io/blog/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltrates-ci-cd-credentials
type: article
source: "StepSecurity"
published: 2026-05-18T20:20:13.986Z
updated: 2026-05-18T20:20:32.940Z
tags: ["security", "cicd", "github-actions"]
reading_time: 2
upvotes: 2
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials

**[StepSecurity](https://daily.dev/sources/stepsecurity)** · 2 min read · 2 upvotes · 0 comments

## Summary

The GitHub Action actions-cool/issues-helper has been compromised in a supply chain attack. An attacker moved all repository tags to point to a malicious imposter commit not present in the normal commit history. When executed, the malicious code downloads the Bun JavaScript runtime, reads memory from the Runner.Worker process to harvest decrypted secrets, and exfiltrates them to an attacker-controlled domain. Any workflow referencing the action by version tag is affected; only those pinned to a known-good full commit SHA are safe. StepSecurity has responded by blocking the action via its Compromised Actions Policy, adding the exfiltration domain to Harden-Runner's global block list, and deploying imposter commit detection to flag affected workflows.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.stepsecurity.io/blog/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltrates-ci-cd-credentials>

## Similar posts on daily.dev

- [Supply Chain Compromise: codfish/semantic-release-action Tags Hijacked to Steal OIDC Tokens and Propagate Backdoors](https://daily.dev/posts/supply-chain-compromise-codfish-semantic-release-action-tags-hijacked-to-steal-oidc-tokens-and-prop-y1h87nkdy) · StepSecurity · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions)

[View this post on daily.dev](https://daily.dev/posts/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltr-12ij52s4u)