Overview
- Researchers at Socket found the actions-cool repositories became accessible again starting September 16 and remained reachable through September 25 with release tags still pointing to the malicious commits.
- The two actions — actions-cool/issues-helper and actions-cool/maintain-one-comment — were first compromised on May 18 to inject obfuscated code that exfiltrated tokens and other CI/CD secrets to an attacker-controlled domain.
- Because those actions commonly run daily and many dependents reference mutable version tags, workflows that did not pin to a pre-May-18 SHA likely executed the old payload within a day of the reactivation.
- Socket and reporters note GitHub’s dependency graph shows large numbers of dependents (Socket cited about 15,000 for issues-helper), though not all repositories necessarily used mutable tags or were exposed.
- Investigators recommend locating and removing affected references, pinning to known-clean SHAs that predate May 18, rotating any secrets available to affected workflows, and auditing recent workflow runs and commit history.