Disabled GitHub Actions Resurrected, Resuming Shai-Hulud Malware

Two compromised actions-cool GitHub Actions came back online on Sept. 16 with malicious May tags intact, briefly reactivating the Mini Shai-Hulud payload.

Two popular issue-housekeeping GitHub Actions — `actions-cool/issues-helper` and `actions-cool/maintain-one-comment` — were compromised on May 18, 2026, during the Mini Shai-Hulud campaign, harvesting CI/CD credentials and exfiltrating them to an attacker-controlled server. GitHub later disabled both repositories for terms-of-service violations. On September 16, 2026, both repositories became accessible again, and because their release tags still pointed to the malicious commits from May 18, any workflow referencing either action by version tag resumed downloading and executing the payload on its next run. Both repositories have since been disabled by GitHub Staff for a second time, with a notice citing a violation of GitHub's terms of service. The reason the repositories were re-enabled, and why their release tags were not cleaned up first, remains unknown.

Most supply chain incidents involve something new: a newly published malicious version, a newly hijacked account, or a newly injected workflow. Socket researcher Karlo Zanki noted that this one did not — no new code was published and no configuration was changed. The malicious code had remained in the affected codebases and was never cleaned up, so all that was required to activate the threat was for the repositories to become downloadable again. According to Socket, most affected repositories probably ran the payload within a day of the re-enablement, since the workflows typically run on a daily schedule or whenever someone opens an issue or pull request, with no further action needed from the threat actor. The activity was linked to the Mini Shai-Hulud cluster via the shared exfiltration domain t.m-kosche[.]com, which appeared in both the GitHub Actions workflows and npm packages from the @antv ecosystem.

The repositories were re-enabled on September 16, 2026, at some point between 11:09 a.m. and 6:16 p.m. GMT+2, according to Socket researcher Karlo Zanki. Their release tags were not cleaned up first, and still pointed to the malicious content introduced on May 18. Visiting either repository now shows GitHub's disablement message. Both sources agree the code targeted CI/CD credentials and exfiltrated them to an attacker-controlled server, and that the overlap in the exfiltration domain ties the incident to the Mini Shai-Hulud activity cluster rather than a separate npm-only incident. Philipp Burckhardt, head of threat intelligence at Socket, told The Hacker News at the time of the original discovery that the shared domain pointed to the same Mini Shai-Hulud cluster. The tag-based attack path worked because movable tags resolve to whatever commit they currently reference — teams that pinned either action to the full commit SHA of a pre–May 18 version were not impacted.

Given that many workflows still used the two actions, the exposure could have led to severe software supply chain risk without the attackers deploying any new exploit or infrastructure. Developers are recommended to locate every reference to the affected actions, treat `actions-cool/issues-helper@v2.2.1` as affected, remove the actions or pin them to a known-clean SHA predating May 18, 2026, rotate all exposed secrets, review workflow run history for newly successful runs after a prolonged period of Set up job failures, and audit repository history for unexpected commits after September 16, 2026. Zanki noted the broader lesson: a mutable tag can be compromised, contained, and then reactivated without any change to your own workflow file, and SHA pinning removes that dependency on the upstream repository's state.