Popular GitHub And npm Tools Hit By Credential-Stealing Attacks
On 19 May 2026, security researchers reported a supply‑chain compromise of the GitHub Action 'actions-cool/issues-helper' and malicious npm packages tied to the 'atool' maintainer account. The campaigns inject credential‑stealing code into CI/CD pipelines and widely used JavaScript libraries.
Key Takeaways
- On 19 May 2026, a widely used GitHub Action, actions-cool/issues-helper, was found compromised, with all existing tags moved to malicious commits.
- The malicious code exfiltrates CI/CD credentials from GitHub Actions runners, posing a serious supply‑chain risk.
- Separately, npm packages maintained by the “atool” account—including echarts-for-react with ~1.1M weekly downloads—were reported to contain credential‑stealing payloads.
- The campaigns, including one dubbed "Mini Shai-Hulud," target developer tools to gain downstream access to organizations’ systems.
- The incidents underscore growing threats to software supply chains and the need for rapid mitigation across development ecosystems.
Early on 19 May 2026, around 04:38–06:14 UTC, security alerts highlighted two significant software supply‑chain attacks targeting core components of the modern development ecosystem. In the first case, a popular GitHub Action named actions-cool/issues-helper was reported compromised. All existing tags for the Action were redirected to a malicious imposter commit, which inserts code intended to steal credentials from GitHub Actions runners.
Because GitHub Actions are used to automate workflows across countless open‑source and corporate projects, a compromise of this nature potentially exposes authentication tokens, secrets, and other sensitive information used in continuous integration and deployment pipelines. Any project that referenced the affected Action by tag rather than by a specific, verified commit hash may have unknowingly executed the attacker’s payload during routine builds or automation tasks.
In a parallel development, security researchers identified a related or at least thematically similar campaign against npm packages tied to the maintainer account "atool." Notably, the popular echarts-for-react package—reportedly with around 1.1 million weekly downloads—was among those modified to include credential‑stealing code. The operation, referred to in reports as "Mini Shai-Hulud," embeds the malicious logic inside developer‑oriented tools, aiming to harvest credentials and potentially gain access to internal systems.
Key actors in these incidents include the unknown threat actors behind the compromises, GitHub and npm as platform providers, and the maintainers whose accounts or repositories were targeted. The attacks appear focused on leveraging trust in widely used development components to propagate into numerous downstream environments.
From a technical standpoint, the pivot to compromising CI/CD infrastructure is particularly concerning. Access to build systems can allow attackers to plant backdoors in software artifacts, manipulate deployment pipelines, or move laterally into cloud and on‑premises environments. Given the scale of usage for both GitHub Actions and npm libraries, even a short window of exposure can affect thousands of organizations.
The broader implications are significant. Software supply‑chain attacks have been rising in prominence, with adversaries recognizing that compromising a few highly trusted components can yield disproportionate access. These latest incidents reinforce the need for stronger authentication for maintainers, routine verification of code integrity, and defence‑in‑depth strategies that assume third‑party components may be compromised.
Organizations using the affected GitHub Action or npm packages must urgently assess their exposure: determining when the malicious versions were introduced, whether their pipelines executed the tainted code, and what secrets or tokens may have been exfiltrated. Incident response teams should treat any exposed credentials as compromised and rotate them immediately, while monitoring for anomalous access patterns.
Outlook & Way Forward
In the coming days, GitHub, npm, and upstream maintainers are likely to issue formal advisories, revoke compromised tokens, and remove or quarantine malicious versions. Security vendors and incident response firms will publish indicators of compromise and detection signatures, helping organizations identify whether they have been affected.
Longer‑term, the incidents will increase pressure on ecosystem providers to implement more robust safeguards: enforced multi‑factor authentication for maintainers, signed releases with verifiable provenance, and better monitoring for anomalous changes to popular projects. Development teams will face growing expectations to pin dependencies to specific hashes, adopt software bills of materials (SBOMs), and integrate supply‑chain security tools into their pipelines.
Strategically, these attacks illustrate that adversaries—whether criminal or state‑linked—see the development toolchain as prime terrain. Policymakers and industry leaders should anticipate more such operations and invest in collaborative defences, including threat intelligence sharing focused specifically on software supply chains. Organizations that move quickly to assess and remediate their exposure to the actions-cool/issues-helper and atool/echarts-for-react compromises will not only reduce immediate risk but also strengthen their resilience against the next wave of similar campaigns.
Sources
- OSINT