{
  "title": "actions-cool GitHub Actions Tag Hijack Credential Theft",
  "summary": "All 53 reviewed tags for actions-cool/issues-helper and all 15 tags for actions-cool/maintain-one-comment were moved to dangling imposter commits that scraped GitHub Actions runner memory and exfiltrated credentials. GitHub now blocks access to both repositories.",
  "date": "2026-05-24",
  "severity": "critical",
  "tags": [
    "supply-chain",
    "github-actions",
    "ci-cd",
    "credential-theft",
    "tag-hijack"
  ],
  "sources_count": 4,
  "indicators": {
    "slug": "actions-cool-github-actions-tag-hijack",
    "since": "2026-05-18T19:10:24Z",
    "until": "unknown",
    "ecosystem": "",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [],
    "packages": [],
    "versions": [],
    "affectedVersions": [],
    "fixedVersions": [],
    "files": [],
    "paths": [],
    "services": [],
    "domains": [
      "t.m-kosche.com"
    ],
    "urls": [],
    "ips": [],
    "hashes": [
      "1c9e803c80cc7fed000022d4c94f4b5bc2e90062",
      "147337a919d92f4bf42f02843682d694650f1e22",
      "7f6120bb10c870b9fde146961a18e5bf0b3d4401",
      "c43d668894bebbeea688878ab6774fa405f22251"
    ],
    "processPatterns": [],
    "networkPatterns": [],
    "telemetrySelectors": []
  }
}