GitHub Actions Resurface with Mini Shai-Hulud Malware

Attackers briefly resurrected a supply-chain threat last week when two third-party GitHub Actions, previously seized in a May malware campaign, were re-enabled with the same malicious code still attached to their release tags. The actions, actions-cool/issues-helper and actions-cool/maintain-one-comment, became accessible again on September 16 and remained active until September 25, allowing any workflow that referenced them by a version tag to silently download and execute the old payload.

This incident, uncovered by researchers at application security firm Socket, traces back to the Mini Shai-Hulud supply-chain attack that infected 323 packages and 639 package versions on the Node Package Manager (npm) index in May. That campaign targeted developer tokens, credentials, and continuous integration and continuous delivery (CI/CD) secrets. GitHub's security team had removed both actions after the initial compromise on May 18, believing the threat neutralized. However, the maintainer later re-enabled the repositories without first cleaning the tags, which still pointed to a commit containing an obfuscated payload inside the index.js file.

Socket's timeline shows the exposure started between 11:09 and 18:16 GMT+2 on September 16. For nine days, any downstream project using the actions by a mutable version tag, rather than a pinned commit hash, would have fetched the tainted code on its next run. The actions are commonly employed for automated issue housekeeping, meaning they run almost daily in many repositories. GitHub's own dependency graph lists roughly 15,000 repositories depending on issues-helper alone, though the actual number that pulled the malicious version is unknown because researchers could not determine how many projects reference the actions by tag versus a locked commit.

The payload in question is the same obfuscated script from May, designed to steal secrets from the CI/CD pipeline. In modern software development, a CI/CD pipeline automatically builds, tests, and deploys code, often with access to sensitive credentials like API keys and database passwords. When a malicious action runs inside that pipeline, it can quietly siphon those secrets to an attacker-controlled server. The re-enablement, even without a fresh attack code, effectively reopened the backdoor for any workflow that had not been updated or reviewed since the initial cleanup.

On September 25, both actions were disabled again on GitHub, causing workflows that still reference them to fail outright instead of executing the malware. While a failing build is disruptive, it is safer than silently exfiltrating credentials. Socket's advisory urges developers to audit all references to both actions, remove them or pin a verified clean commit, review workflow runs executed between September 16 and 25, and immediately rotate any secrets those workflows could access. For website owners who rely on such automated integrations, a managed hosting environment like AEU Hosting provides ongoing malware scanning and security hardening, helping to limit the blast radius when external dependencies are compromised.

The Mini Shai-Hulud attack illustrates how supply-chain risks can resurface long after initial containment if maintainers do not thoroughly sanitize repositories. The npm ecosystem, widely used by JavaScript developers, is a frequent target because a single infected package can trickle down to thousands of projects. This case is a reminder that disabling an action is not enough; the tags and commits themselves must be purged of malicious content. Defenders are also advised to adopt the practice of pinning third-party actions to a specific, audited commit hash rather than a floating tag, a measure that would have prevented the automatic redeployment of the malware.