Poisoned Pipeline

Poisoned Pipeline / Incidents / AS197

AS197 · 2026-05

actions-cool GitHub Action tags still serve Mini Shai-Hulud after re-enablement

Git / GitHubGitHub ActionsVS Code / IDEAI coding agents

On 18 May 2026 an attacker moved all 53 tags of actions-cool/issues-helper
and all 15 tags of actions-cool/maintain-one-comment to unsigned
"Build action for <tag>" commits. The malicious action.yml runs a Bun
payload first, then the real action so the workflow still succeeds.
GitHub disabled both repositories on 19 May (terms-of-service), which
stopped downloads. On 16 September 2026 both repositories became
reachable again with the May tags still pointing at the payload, so
every workflow that pins by tag rather than SHA resumed executing it.
SafeDep found six newly infected default branches between 20 and 24
September (jd-opensource/micro-app, MaaXYZ/MaaFramework,
ant-design/pro-components, Moonofweisheng/wot-design-uni,
vbenjs/vben-admin-thin-next, nineaiyu/xadmin-client). The payload
reads the ghs_ token from Runner.Worker memory, commits .claude/ and
.vscode/tasks.json hooks (github-actions[bot], GraphQL), and on a
developer machine installs kitty-monitor. Byte-identical to the May
Mini Shai-Hulud build (blob 2931c1be, 500,143 bytes); C2
t.m-kosche.com. The payload also writes 127.0.0.1 stepsecurity.io
entries on the runner. Socket reports ~15,000 dependents of
issues-helper. Tags were not cleaned before re-enablement.

SafeDep’s September 2026 follow-up: six more repositories (micro-app,
MaaFramework, ant-design/pro-components, wot-design-uni, vben-admin,
xadmin-client) received the hook files between 20–24 September — four
months after the tag hijack, the 53+15 tags still point at the malicious
commits. Payload adds Claude Code SessionStart and VS Code tasks hooks
(kitty-monitor backdoor, gh-token monitor, a wiper that runs on 40x or
@cap-js deprecation), blocks stepsecurity.io via /etc/hosts, and commits
as verified github-actions[bot] via GraphQL.

Mapped techniques

supply-chain Hijacked actions-cool tags

T0122 · Initial Access · Vulnerability in third-party CI/CD actions

Workflows that call actions-cool/issues-helper or maintain-one-comment by mutable tag.

T0121 · Resource Development · Compromised legitimate artifact

Real actions-cool issue-bot actions; tags rewritten 18 May 2026, still malicious in September.

T0109 · Resource Development · Publish malicious artifact

53 issues-helper tags and 15 maintain-one-comment tags moved to wrapper commits that run Bun then the real action.

T0159 · Execution · Malicious artifact execution

oven-sh/setup-bun then bun run $GITHUB_ACTION_PATH/index.js on the runner before the housekeeping step.

T0183 · Credential Access · Harvesting short-lived token

Payload reads the ghs_ token from Runner.Worker memory.

T0140 · Credential Access · Harvest tokens from environment variables

CI secrets available to the composite action are stolen, then used to commit into the consuming repo.

T0193 · Collection · Sensitive information in environment variables

Issue-bot workflows often run on schedule or issue events with a repo token.

T0202 · Persistence · Inadequate CI/CD workflow permissions

GITHUB_TOKEN was enough to push verified github-actions[bot] commits onto default branches.

T0169 · Lateral Movement · Push implants across repositories

Six public default branches received .claude/ and .vscode hook commits 20–24 September 2026.

T0210 · Persistence · Poison AI coding-agent config or workspace

.claude/settings.json SessionStart and .vscode/tasks.json run node .claude/setup.mjs on folder open.

T0152 · Execution · IDE

VS Code folderOpen task downloads Bun 1.3.14 and runs the same index.js on the developer machine.

T0176 · Defense Evasion · Disable or misconfigure security measures

Payload sudo-writes 127.0.0.1 stepsecurity.io entries into /etc/hosts on the runner.

T0168 · Exfiltration · Exfiltration to code repositories

Commits go through the GraphQL API with the victim repository token so GitHub shows them as verified.

Framework gaps noted

Sources