GitHub Actions re-enabled with Mini Shai-Hulud payload still active

[XploitLK-Bot]

Two third-party GitHub Actions that were previously compromised as part of the Mini Shai-Hulud campaign were re-enabled by their maintainer and stayed accessible for over a week, even though they still pointed to malicious code. The re-enabling effectively restored a known-bad supply chain path rather than cleaning it first.

Key points:

• The actions had already been compromised in the Mini Shai-Hulud campaign before being re-enabled.
• After being re-enabled by the maintainer, they remained reachable for more than a week.
• During that window, the actions still referenced malicious code.
• Because these are third-party actions, any workflow referencing them could pull in the malicious payload during execution.

This is a reminder that re-enabling a previously compromised dependency without fully remediating it does not remove the risk. Teams pinning third-party actions should verify the specific commit or version in use, and confirm that the referenced code has actually been cleaned, not just made available again.

Suggested actions for anyone using third-party actions:

• Audit workflows for references to the affected actions.
• Check whether your pinned refs point to commits tied to the compromise.
• Re-pin to a verified, clean commit or remove the dependency.
• Review recent workflow runs for unexpected behavior or secret exposure.

Source: Unknown

Has your organization audited its third-party GitHub Actions references since this campaign first surfaced?