Compromised GitHub Actions Tags Contain Code Targeting CI/CD Credentials
Summary
StepSecurity reported malicious commits in two actions-cool GitHub Actions repositories, with code designed to extract runner credentials and send them to t[.]m-kosche[.]com. GitHub disabled access to one repository; a link to Mini Sha-Hulud is possible.
Key points
- StepSecurity reported that every existing tag in actions-cool/issues-helper was redirected to an imposter commit outside the action’s normal history.
- The malicious code downloads the Bun JavaScript runtime and reads Runner.Worker memory to extract CI/CD credentials.
- The code sends data to t[.]m-kosche[.]com; the article does not establish that credentials were successfully exfiltrated.
- StepSecurity also found 15 compromised tags in actions-cool/maintain-one-comment with the same functionality.
- GitHub disabled access to actions-cool/issues-helper for a terms-of-service violation.
- The exfiltration domain was observed in activity targeting npm packages in the @antv ecosystem; a connection to Mini Sha-Hulud is possible, not confirmed.
- Workflows pinned to a known-good full commit SHA are reported as unaffected.
Article Details
- Victim Organization
- actions-cool (owner of the compromised GitHub Actions repositories)
- Incident Type
- Software supply chain compromise involving malicious commits and poisoned tags that executed code in CI/CD workflows and exfiltrated credentials
- Data Types Exposed
- CI/CD credentials
- Operational Impact
- Malicious code in actions-cool/issues-helper could execute on GitHub Actions runners, read Runner.Worker memory to extract credentials, and transmit the stolen data. StepSecurity also reported 15 compromised tags in actions-cool/maintain-one-comment. GitHub disabled access to the repository. Workflows pinned to a known-good full commit SHA were reported unaffected.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | t[.]m-kosche[.]com | Attacker-controlled exfiltration domain that the malicious code contacted over HTTPS to transmit stolen CI/CD credentials; the article says it may be linked to the Mini Sha-Hulud campaign. |