Threat actors redirected all version tags for two widely-used GitHub Actions, actions-cool/issues-helper and actions-cool/maintain-one-comment, to malicious commits, causing any CI/CD pipeline referencing those actions by tag to automatically execute attacker-controlled code. The payload actively exfiltrates CI/CD secrets, credentials, and tokens to an attacker-controlled domain. The same infrastructure connects to the ‘Mini Shai-Hulud’ npm supply chain campaign, attributed to TeamPCP with high confidence per Wiz research, confirming a coordinated, multi-ecosystem operation that puts software build pipelines and everything they touch at direct risk of compromise.