GitHub Re-Enabled Compromised Actions, Leaving the Mini Shai-Hulud Payload Active

Two third-party GitHub Actions previously compromised in the Mini Shai-Hulud campaign remained accessible for more than a week after administrators re-enabled them. Both actions still pointed to malicious code, putting downstream workflows at risk of downloading and executing the old payload.

Compromised GitHub Actions Were Re-Enabled

After the breach on May 18, GitHub’s security team removed actions-cool/issues-helper and actions-cool/maintain-one-comment to prevent downstream workflows from downloading the malware.

According to researchers at application security firm Socket, both actions became active again between September 16 and September 25. They retained the same release tags, meaning workflows that referenced those tags could download and execute the malicious payload.

Socket researchers discovered last Wednesday that the release tags for actions-cool/issues-helper and actions-cool/maintain-one-comment resolved to commits containing obfuscated payloads in the index.js file.

Socket explained that both repositories became accessible again on September 16, 2026, but their release tags had not initially been cleaned up.

“Because they still point to the malicious content introduced on May 18th, workflows that reference either action by version tag will resume downloading and executing the payload the next time they run.”

It is unclear why the repositories were re-enabled without first being properly cleaned.

Mini Shai-Hulud Attack Targeted Developer Secrets

The Mini Shai-Hulud supply chain attack in May affected 323 packages and 639 package versions on the Node Package Manager (npm) index. The malware targeted developer tokens, credentials, and CI/CD secrets.

GitHub’s dependency graph lists approximately 15,000 repositories that depend on issues-helper, according to Socket. However, this does not mean that all of those repositories were compromised.

The researchers said the number of dependencies referring to either action through a mutable tag rather than a pinned commit had not yet been established. The affected actions are used frequently to support issue-management tasks.

GitHub Disabled the Actions Again

On September 25, Socket discovered that both actions had once again been disabled on GitHub. As a result, workflows referencing them would fail rather than execute the payload.

Exposure began on September 16 between 11:09 and 18:16 GMT+2.

What Developers Should Do

Socket recommends finding and removing references to both actions or replacing them with verified clean commits. Organizations should also review workflow executions from September 16 onward and rotate any secrets that could be accessed by workflows using the affected tags.

Potentially affected developers should search their repositories for references to actions-cool/issues-helper and actions-cool/maintain-one-comment, remove those references, or pin the actions to verified clean commits.

Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.

Please reserve your seat