actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials - StepSecurity

What it is

An active supply-chain compromise of two GitHub Actions in the actions-cool org — issues-helper (53 tags) and maintain-one-comment (15 tags). An attacker with tag-move access re-pointed every version tag to a per-tag "imposter commit" that is dangling (unreachable from the default branch) and carries a credential-stealing payload. Both actions use the identical payload and exfil domain, so treat them as one incident.

How it works

Each imposter commit runs code inside the Actions runner that:

• downloads the bun JavaScript runtime to /home/runner/.bun/bin/bun;
• spawns a python3 child (via sudo) that reads /proc/<Runner.Worker PID>/mem — the process holding the workflow's decrypted secrets;
• pulls gh auth token and pipes memory through tr/grep filtering for "isSecret":true;
• sends the harvested credentials over HTTPS to t.m-kosche.com on port 443.

Preconditions / Affected

Any workflow that references either action by tag or version pulls malicious code on its next run. Workflows pinned to a known-good full commit SHA are unaffected — that is the entire dividing line.

What to do

• Stop referencing these actions by tag/version. Pin to a verified pre-attack commit SHA, or remove the actions until resolved.
• Hunt runner logs for the payload markers above (bun download path, /proc/.../mem reads from python3, the "isSecret":true filter, outbound to t.m-kosche.com).
• Block egress to t.m-kosche.com as defense-in-depth (StepSecurity has added it to the Harden-Runner global block list; enterprise Compromised Actions Policy blocks the run outright).
• Use imposter-commit detection: flag any action reference resolving to a SHA that matches no legitimate tag or branch head.

Caveats

The distinguishing tell is the timestamps, not the code — the fake "Build action for vX.Y.Z" messages mimic the maintainer's real style, but all 53 issues-helper imposter commits were created within a 3-minute-16-second window and all 15 in maintain-one-comment within 39 seconds. A commit SHA alone is not proof of safety; verify the SHA is reachable from the default-branch history and predates the attack window.

flowchart TD
  A[Workflow references action] --> B{Pinned by?}
  B -->|Tag / version| C[Resolves to imposter commit]
  B -->|Verified pre-attack SHA| S[Safe]
  C --> D[bun + python3 read Runner.Worker mem]
  D --> E[Exfil to t.m-kosche.com:443]
  E -.blocked by.-> F[Egress block / Harden-Runner]