GitHub Actions Re-enabled with Malicious Payload After Mini Shai-Hulud Attack

Two previously compromised actions remained accessible for over a week despite still pointing to malware, exposing workflows to token theft

edit

By LineZotpaper

Published27 September 2026

Read Time2 min

Two third-party GitHub Actions previously compromised in the May 2026 Mini Shai-Hulud supply-chain attack were re-enabled by their maintainer and remained accessible for more than a week, still resolving to malicious code that steals developer tokens and credentials, researchers at application security company Socket have disclosed.

The two actions — actions-cool/issues-helper and actions-cool/maintain-one-comment — were originally compromised on May 18 as part of the Mini Shai-Hulud campaign that infected 323 packages and 639 versions on the npm registry. GitHub Security removed both actions at the time to prevent downstream workflows from downloading the malware.

According to Socket, the repositories became accessible again on September 16, 2026, without their release tags being cleaned up. Workflows referencing either action by a version tag resumed downloading and executing the obfuscated payload found in the index.js file. The exposure continued until September 25, when GitHub disabled the actions once more.

“On September 16, 2026, both repositories became accessible again. Their release tags were not cleaned up first,” Socket explained. “They still point to the malicious content introduced on May 18, so any workflow that references either action by a version tag resumed downloading and executing the payload on its next run.”

The researchers noted that GitHub’s dependency graph lists approximately 15,000 repositories depending on issues-helper, though not all are necessarily compromised. The impact depends on whether workflows reference the actions by mutable tags rather than pinned commits. Because these actions run nearly daily for issue housekeeping, the window of exposure is significant.

Socket recommends that potentially affected developers search for references to both actions, remove them or pin a verified clean commit, review workflow runs since September 16, and rotate any secrets accessible to workflows that ran an affected tag. The exposure began on September 16 between 11:09 and 18:16 GMT+2.

Analysis

Why This Matters

Developers using these common GitHub Actions may have inadvertently executed malware in their CI/CD pipelines, exposing tokens, credentials, and secrets to attackers.
The incident highlights the fragility of the open-source supply chain: even after a malicious package is removed, the risk can resurface if cleanup is incomplete.
With 15,000 repositories potentially depending on one of the re-enabled actions, the blast radius could be substantial, though not all are confirmed affected.

Background

The Mini Shai-Hulud campaign, first disclosed in May 2026, targeted the npm ecosystem by compromising packages that stole environment variables, tokens, and CI/CD secrets. As part of that campaign, the two actions-cool repositories were compromised. GitHub took them down promptly, but the maintainer later re-enabled them without removing the old, malicious release tags. Supply-chain attacks like this exploit the trust developers place in third-party actions, which are often referenced by mutable version tags.

Key Perspectives

Security researchers (Socket): The re-enablement without tag cleanup was a critical oversight. They emphasize that any workflow referencing the actions by tag — a common practice — would have downloaded the payload. They urge developers to audit runs and rotate secrets. GitHub Security: The platform acted twice to disable the actions. However, the initial re-enablement by the maintainer shows that permissions and automatic tag cleanup may not be enforced after an incident. Affected developers: Those who used the actions face a time-consuming review of logs and secret rotation. The incident underscores the risk of relying on third-party actions without pinning to specific commits.

What to Watch

Whether GitHub updates its incident response to automatically prevent re-enablement of compromised actions without a clean slate.
Adoption of pinned commit references (vs. mutable tags) in the developer community.
Any further disclosures from Socket or other researchers about additional compromised actions from the same campaign.

Sources

GitHub Actions re-enabled with Mini Shai-Hulud payload still active — BleepingComputer