Supply-chain attacksBriefConfirmed by two or more outlets
actions-cool/issues-helper and maintain-one-comment re-enabled with malware
Both were compromised in May 2026. The repos came back on 16 Sep with the payload still in place, so tag-pinned workflows ran it again.
- Disclosed
What happened
- Both were compromised in May 2026. The repos came back on 16 Sep with the payload still in place, so tag-pinned workflows ran it again. SafeDep found 6 more infected repos from 20 to 24 Sep.
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.