Key points:

• The actions had already been compromised in the Mini Shai-Hulud campaign before being re-enabled.
• After being re-enabled by the maintainer, they remained reachable for more than a week.
• During that window, the actions still referenced malicious code.
• Because these are third-party actions, any workflow referencing them could pull in the malicious payload during execution.

This is a reminder that re-enabling a previously compromised dependency without fully remediating it does not remove the risk. Teams pinning third-party actions should verify the specific commit or version in use, and confirm that the referenced code has actually been cleaned, not just made available again.

Suggested actions for anyone using third-party actions:

• Audit workflows for references to the affected actions.
• Check whether your pinned refs point to commits tied to the compromise.
• Re-pin to a verified, clean commit or remove the dependency.
• Review recent workflow runs for unexpected behavior or secret exposure.

Source: Unknown

Has your organization audited its third-party GitHub Actions references since this campaign first surfaced?