Compromised GitHub Action Exfiltrates Workflow Credentials to Attacker Domain

Cybersecuritynews •Tushar Subhra Dutta • May 19, 2026

A widely used GitHub Action called actions-cool/issues-helper has been compromised, with every version tag in the repository silently redirected to a malicious commit. The attack places stolen CI/CD pipeline credentials directly in the hands of an attacker, raising serious concerns for development teams around the world that rely on this action in their automated workflows. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Supply Chain Attack on GitHub Action Exposes CI/CD Credentials A supply chain attack has compromised the GitHub Action 'actions-cool/issues-helper', exposing sensitive CI/CD secrets. The attacker manipulated Git tags, redirecting them to an imposter commit (1c9e803) without altering the visible commit history. This method allows the attacker to gain access to workflow credentials, potentially affecting numerous repositories that utilize this action. The incident highlights vulnerabilities in CI/CD processes and the importance of securing third-party integrations. As of now, the full scope of the impact is still being assessed, but users are advised to review their workflows for potential exposure. 3 sources 68

Extracted Entities

Compromised GitHub Action Exfiltrates Workflow Credentials to Attacker Domain

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Tools (1)