2026-05-18 · 2026-Q2
actions-cool GitHub Actions Tag Hijack (Mini Shai-Hulud)
Outside the model: Adjacent ecosystemAgent tooling was not the attack surface, so no layer applies.
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Not applicable
Target
`actions-cool/issues-helper` (all 53 tags) and `actions-cool/maintain-one-comment` (15 tags), retargeted to a single imposter commit
Impact
A Bun-based payload reads decrypted secrets directly from the `Runner.Worker` process memory inside GitHub Actions and exfiltrates CI/CD credentials from every workflow that pinned the actions by tag
Root cause
Repository or maintainer compromise plus mutable-tag retargeting, attributed to the TeamPCP Mini Shai-Hulud campaign
Sources
Catalog
Cite this: AgentProv incident record: actions-cool GitHub Actions Tag Hijack (Mini Shai-Hulud) (2026-05-18). https://agentprov.com/incidents/2026-05-18-actions-cool-github-actions-tag-hijack-mini-shai-hulud