# actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials

All tags of actions-cool/issues-helper and maintain-one-comment were moved to dangling imposter commits that read Runner.Worker memory to steal CI/CD secrets and exfiltrate them to t.m-kosche.com.

- Payout: Real-world hack
- Severity: critical
- Program: actions-cool
- Analysis by: StepSecurity
- Disclosed: 2026-05-19
- Write-up quality: 7/10
- Original: https://www.stepsecurity.io/blog/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltrates-ci-cd-credentials
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltr
- Tags: area:cloud domain:cloud impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:github-actions technique:recon technique:source-review vuln:secrets-leak

**Target:** GitHub Actions (issues-helper, maintain-one-comment) CI/CD runners
**Root cause:** Attacker gained tag-move rights in the actions-cool repos and re-pointed every release tag to dangling imposter commits containing malicious index.js. Workflows referencing tags by version pull the malicious code.
**Steps:**
1. Observe all 53 issues-helper tags and 15 maintain-one-comment tags resolve to commits not reachable from default branch (e.g. `v3 -> 147337a919d92f4bf42f02843682d694650f1e22`)
2. Imposter commits created in tight windows (3m16s and 39s) with fake 'Build action for vX.Y.Z' messages
3. On workflow run, malicious index.js downloads bun to `/home/runner/.bun/bin/bun`
4. bun spawns python3 child that reads `/proc/<Runner.Worker PID>/mem`
5. Child runs `gh auth token`, escalates via `sudo python3`, pipes memory through `tr`/`grep` filtering for `"isSecret":true`
6. Exfiltrates harvested secrets via HTTPS POST to `t.m-kosche.com:443`
**How found:** Detection via Harden-Runner: imposter-commit badge on the action step, suspicious process spawn (bun, python3 reading /proc/*/mem), and anomalous outbound call to t.m-kosche.com; tag timestamps clustered within minutes revealed the mass re-pointing.
**Exploitation:** Any workflow referencing the action by tag executes the imposter commit on next run; payload scrapes decrypted secrets from Runner.Worker process memory and exfiltrates them to attacker domain, yielding CI/CD credentials and tokens.
**Escalation:** Same actor compromised a second action in the org (maintain-one-comment) with identical payload and exfil domain, widening blast radius across dependent workflows.
**Insight:** Tag-based action references are mutable supply-chain trust: monitor for tags resolving to commits unreachable from the default branch, and watch for processes reading /proc/<Runner.Worker>/mem or spawning runtimes (bun/node) not expected by the action.