<![CDATA[Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware]]>

<![CDATA[Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware]]>Two actions-cool GitHub Actions have been disabled again after their repositories briefly became accessible last week. The actions were originally compromised during the May 2026 Mini Shai-Hulud campaign, and the recent reopening apparently allowed the malicious code to resume execution.

The affected actions are:

actions-cool/issues-helper
actions-cool/maintain-one-comment

Visiting either repository now returns a message stating that access to the repository has been restricted, confirming the second takedown. Anyone who consumed these actions during the window when they were live should treat their workflows as potentially exposed and audit recent pipeline activity for unexpected behavior tied to the Mini Shai-Hulud malware.

If your organization references either action, pin dependencies to vetted commit SHAs, review workflow logs from the period the repositories were accessible, and rotate any secrets those jobs could reach.

Source: The Hacker News
Has your team audited its CI/CD pipelines for exposure to these compromised actions?

]]>https://xploitlk.com/topic/465/compromised-github-actions-came-back-online-and-resumed-executing-mini-shai-hulud-malwareRSS for NodeTue, 27 Oct 2026 08:16:00 GMTFri, 25 Sep 2026 20:30:24 GMT60