MalwarePublished 26 Sep 2026

GitHub Actions re-enabled with Mini Shai-Hulud payload still active

Source Bleeping Computer

Description

Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. [...]

Impact

The re-enabled malicious GitHub Actions allowed workflows that referenced them by version tags to download and execute malware, potentially exposing developer tokens, credentials, and CI/CD secrets. This could lead to unauthorized access or compromise of development environments and continuous integration/deployment pipelines. The exposure lasted from September 16 to September 25, 2026. The exact number of affected repositories is unclear, but the dependency graph shows about 15,000 repositories depending on one of the affected actions. The incident could have led to widespread supply-chain compromise within affected development workflows.

Defensive guidance

GitHub disabled the malicious actions again on September 25, 2026, preventing further execution of the payload. Developers should identify any workflows referencing actions-cool/issues-helper or actions-cool/maintain-one-comment, remove these references, or pin them to verified clean commits. Additionally, developers should review workflow runs between September 16 and September 25, 2026, and rotate any secrets or credentials accessible to those workflows to mitigate potential compromise. No further action is required from GitHub users beyond these steps as the malicious actions are currently disabled.

Summary

In May 2026, the Mini Shai-Hulud campaign compromised 323 npm packages, including two GitHub Actions repositories: actions-cool/issues-helper and actions-cool/maintain-one-comment. These actions were removed by GitHub security to prevent malware distribution. However, starting September 16, 2026, the maintainer re-enabled these repositories without cleaning the malicious payload, causing workflows referencing these actions by version tags to resume downloading and executing the malware. The payload is obfuscated in the 'index.js' file and targets developer tokens, credentials, and CI/CD secrets. Approximately 15,000 repositories depend on 'issues-helper', though the exact number affected by mutable tags is unknown. GitHub disabled the actions again on September 25, 2026. Socket researchers recommend removing references or pinning to clean commits and rotating secrets.

References

bleepingcomputer.com/news/security/github-actions-re-enabled-with-mini-shai-hulud-payload-still-active/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Sep 2026, 14:32 UTC

References

Community reviews