Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
-
Two actions-cool GitHub Actions have been disabled again after their repositories briefly became accessible last week. The actions were originally compromised during the May 2026 Mini Shai-Hulud campaign, and the recent reopening apparently allowed the malicious code to resume execution.
The affected actions are:
- actions-cool/issues-helper
- actions-cool/maintain-one-comment
Visiting either repository now returns a message stating that access to the repository has been restricted, confirming the second takedown. Anyone who consumed these actions during the window when they were live should treat their workflows as potentially exposed and audit recent pipeline activity for unexpected behavior tied to the Mini Shai-Hulud malware.
If your organization references either action, pin dependencies to vetted commit SHAs, review workflow logs from the period the repositories were accessible, and rotate any secrets those jobs could reach.
Source: The Hacker News
Has your team audited its CI/CD pipelines for exposure to these compromised actions?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login