2026-05-18 · 2026-Q2
actions-cool GitHub Actions Tag Hijack (Mini Shai-Hulud)
Outside the model: Adjacent ecosystem Agent tooling was not the attack surface, so no layer applies.
- Fixable:
- Yes, vendor patch
- Vendor response:
- Unknown
- In the wild:
- Yes
Target
`actions-cool/issues-helper` (all 53 tags) and `actions-cool/maintain-one-comment` (15 tags), retargeted to a single imposter commit
Impact
A Bun-based payload reads decrypted secrets directly from the `Runner.Worker` process memory inside GitHub Actions and exfiltrates CI/CD credentials from every workflow that pinned the actions by tag
Root Cause
Repository or maintainer compromise plus mutable-tag retargeting, attributed to the TeamPCP Mini Shai-Hulud campaign