Here is a concise summary of the article in 3 sentences: A vulnerability in GitHub Actions workflow, actions-cool/issues-helper, has allowed threat actors to redirect popular GitHub Actions to an imposter commit that steals sensitive credentials and exfiltrates them to an attacker-controlled server. The imposter commit, which contains malicious code that downloads and exfiltrates credentials, has been compromised in two separate GitHub Actions, and 15 additional tags have been targeted, including "actions-cool/maintain-one-comment". The compromised actions have been disabled due to a violation of GitHub's terms of service, and the attackers are likely linked to the Mini Shai-Hulud campaign targeting npm packages from the @antv ecosystem.