{"id":963,"date":"2026-05-19T05:49:55","date_gmt":"2026-05-19T05:49:55","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=963"},"modified":"2026-05-19T05:49:55","modified_gmt":"2026-05-19T05:49:55","slug":"popular-github-action-tags-redirected-to-imposter-commit-to-steal-ci-cd-credentials","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=963","title":{"rendered":"Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI\/CD Credentials"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>May 19, 2026<\/span><\/span>Software Security \/ Malware<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

In yet another software supply chain attack, threat actors have compromised the popular GitHub Actions workflow, actions-cool\/issues-helper<\/b>, to run malicious code that harvests sensitive credentials and exfiltrates them to an attacker-controlled server.<\/p>\n

\u00abEvery existing tag in the repository has been moved to point to an imposter commit that does not appear in the action’s normal commit history,\u00bb StepSecurity researcher Varun Sharma said<\/a>. \u00abThat commit contains malicious code that exfiltrates credentials from CI\/CD pipelines that run the action.\u00bb<\/p>\n

An imposter commit<\/a> refers to a deceptive software supply chain attack strategy in which malicious code is injected into a project by referencing a commit or tag that exists only in an adversary-controlled fork, rather than the original trusted repository. As a result, attackers can bypass standard Pull Request (PR) reviews and achieve arbitrary code execution.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The imposter commit, per the cybersecurity company, contains code that, upon being executed within a GitHub Actions runner, performs a series of actions –<\/p>\n