project

actions-cool/maintain-one-comment

Open-source GitHub Action from the actions-cool organization that keeps a single bot comment up to date on issues or pull requests.

Known aliases

maintain-one-comment

Relationships

No evidence-backed relationships are recorded.

Current clusters

build1 publisher

Tag-pinned workflows re-ran Mini Shai-Hulud after issues-helper was re-enabled

Socket says workflows using [email protected] re-ran Mini Shai-Hulud after the Action was re-enabled on September 16 with its malicious tags intact. The earlier takedown only made those jobs fail, so the fix that holds is dropping the Action or pinning a verified commit SHA.

Publishers:dev.to

Reality

Evidence55
Adoption35
Hype gap+10
Incentives: Insufficient
Confidence55

security3 publishers

Two actions-cool GitHub Actions resumed running the Mini Shai-Hulud stealer after coming back online

Two actions-cool GitHub Actions hijacked on May 18 came back online on September 16, still serving the Mini Shai-Hulud stealer to tag-pinned workflows. Only workflows pinned to a pre-May 18 commit SHA escaped; the rest have CI secrets to rotate.

Publishers:bleepingcomputer.comscworld.comthehackernews.com

Perspective Coverage

3 publishers

Builder: Builder 48%
Operator: Operator 47%
Investor: Investor 5%

Reality

Evidence64
Adoption45
Hype gap+15
Incentives40
Confidence66