GitHub Actions re-enabled with Mini Shai-Hulud payload still active
Two compromised GitHub Actions stayed live for nine days still serving the Mini Shai-Hulud payload.
Socket found that GitHub Actions actions-cool/issues-helper and actions-cool/maintain-one-comment, removed after a May 18 Mini Shai-Hulud compromise, were accessible again from September 16 to September 25, 2026, with release tags still pointing at the malicious commit. Workflows that referenced those tags downloaded and executed an obfuscated payload in index.js that targets developer tokens, credentials, and CI/CD secrets. The May campaign infected 323 npm packages and 639 versions. GitHub lists about 15,000 repositories depending on issues-helper, though not all pin mutable tags. Both actions were disabled again on September 25; Socket advises removing or pinning a clean commit, reviewing runs since September 16, and rotating exposed secrets.
- issues-helper and maintain-one-comment were re-enabled September 16-25.
- Release tags still resolved to the May 18 malicious commit.
- The May wave infected 323 npm packages and 639 versions.
- About 15,000 repositories depend on issues-helper.
- Both actions were disabled again on September 25.
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1195.002 Compromise Software Supply ChainT1059.007 JavaScriptT1528 Steal Application Access Token
- Vendors
- GitHub
- Products
- GitHub Actionsnpm
- Malware
- Mini Shai-Hulud
- Organizations
- SocketGitHubactions-cool
From the original article
2 min read at bleepingcomputer.com
Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.