Compromised GitHub Actions Reactivate Mini Shai-Hulud Malware

Two popular GitHub Actions repositories have been disabled for a second time after becoming accessible again last week. This development occurred months after the projects were initially compromised during the Mini Shai-Hulud campaign in May 2026. The affected tools, maintained by the user actions-cool, are issues-helper and maintain-one-comment. These utilities are widely used in software development workflows to automate issue tracking and comment management.

Visiting the repositories now displays a message from GitHub Staff stating that access has been disabled due to a violation of the platform's terms of service. However, before this final block, the repositories briefly reopened on September 16, 2026. Socket researcher Karlo Zanki confirmed that during this window, the release tags were not cleaned up. They continued to point to the malicious content introduced on May 18, 2026. Consequently, any workflow referencing either action by its version tag resumed downloading and executing the payload on its next scheduled run.

The original compromise on May 18 was designed to harvest sensitive credentials from Continuous Integration and Continuous Deployment (CI/CD) pipelines. The malicious code exfiltrated these details to an attacker-controlled server. Security analysts linked this activity to the broader Mini Shai-Hulud cluster, noting overlaps in the exfiltration domain t.m-kosche[.]com with other incidents involving npm packages from the @antv ecosystem. Philipp Burckhardt, head of threat intelligence at Socket, previously stated that this indicated a single coordinated activity cluster rather than separate, isolated incidents.

The re-enablement of these repositories highlights a critical supply chain vulnerability. The malicious code remained embedded in the affected codebases and required no updates or new configurations to become active again. Because many workflows still reference these actions, the exposure created severe security risks. Most affected repositories likely executed the payload within a day of the re-enablement, as the actions typically run on daily schedules or when new issues and pull requests are opened. This means threat actors did not need to deploy new exploits or infrastructure to reactivate the attack.

Workflows that pin these actions to the full commit SHA of a version released before May 18, 2026, remain unaffected. Developers are advised to locate every reference to the affected actions and treat version v2.2.1 as compromised. The recommended mitigation involves removing the current actions and pinning them to a known-clean SHA that predates the compromise date. Additionally, organizations should rotate all exposed secrets, review workflow history for successful runs after periods of failure, and audit repository history for unexpected commits after September 16, 2026.

Zanki emphasized that most supply chain incidents involve new elements, such as newly published malicious versions or hijacked accounts. This incident is distinct because it relies on a mutable tag that was compromised, contained, and then reactivated without any change to the consumer's workflow file. SHA pinning removes the dependency on the upstream repository's state, ensuring that even if a repository is re-enabled or updated maliciously, the workflow continues to use the verified, clean version. For website owners and IT teams managing hosted environments, this underscores the importance of verifying third-party dependencies and using immutable references to prevent silent re-infection.

AEU Group offers AEU-I, providing security-first IT infrastructure and consulting to help businesses secure their digital assets against such supply chain vulnerabilities.