GitHub Actions Workflow Compromised: actions-cool/issues-helper Harvests Credentials
Delete the compromised actions-cool/issues-helper workflow and replace it with a trusted version or custom action.
Delete the compromised workflow, audit all GitHub Actions, and enforce signed commits and permission restrictions.
Summary
Threat actors have compromised the popular GitHub Actions workflow, actions-cool/issues-helper, by hijacking every tag in the repository to point to an imposter commit that does not appear in the action’s normal commit history. The malicious commit injects code that harvests sensitive credentials from the workflow environment and exfiltrates them to an attacker‑controlled server. The attack leverages the trust model of GitHub Actions, where workflows run with the permissions of the repository’s default branch. GitHub’s investigation confirmed that the compromised tags were created by an attacker who gained access to the repository’s maintainer account. The compromised workflow was used in dozens of projects, potentially exposing credentials across the ecosystem. GitHub has revoked the maintainer account and is working to restore the original tags. Developers are advised to remove the compromised workflow and replace it with a trusted version or a custom action. The incident underscores the importance of signing workflows and restricting permissions for third‑party actions.
Key changes
- actions-cool/issues-helper tags hijacked to imposter commits.
- Malicious code harvests credentials and exfiltrates to attacker server.
- Attack exploits GitHub Actions trust model.
- Maintainer account compromised, tags replaced.
- Compromised workflow used in dozens of projects.
- GitHub revoked maintainer account and restoring original tags.
- Developers advised to remove compromised workflow.
- Incident highlights need for signed workflows and permission restrictions.