GitHub Actions Compromised in ‘Mini Shai-Hulud’ Attack Disabled Again Following Brief Reappearance

The cybersecurity landscape has been reminded once again of the persistent and often "zombie-like" nature of supply chain threats. In a development that has raised significant questions regarding the cleanup and remediation protocols of major development platforms, two popular GitHub Actions associated with the "actions-cool" organization were disabled for a second time last week. This administrative intervention by GitHub staff followed a brief and unexplained window during which the repositories became accessible to the public, despite having been identified months earlier as vehicles for malicious code during the significant "Mini Shai-Hulud" supply chain campaign of May 2026.

The incident highlights a critical gap in how compromised open-source assets are managed after an initial breach is detected. While the repositories were originally taken offline in the wake of the spring attacks, their sudden reappearance on September 16, 2026, occurred without the necessary removal of the malicious components. Because the underlying codebases remained tainted, any developer or organization whose automated workflows were still configured to call upon these actions was immediately placed at risk of data theft and pipeline compromise the moment the repositories were set back to "public" status.

The history of this specific threat dates back to May 18, 2026, a period that marked the height of the Mini Shai-Hulud activity cluster. During this time, threat actors successfully compromised the workflows of several GitHub Actions designed to assist maintainers with repository housekeeping. These tools, which automate tasks such as closing inactive issues, managing bot-generated comments, and triaging new pull requests, are widely used across the GitHub ecosystem to reduce the manual burden on software developers. However, the very automation that makes them valuable also makes them an ideal delivery mechanism for malware.

By injecting malicious code into these actions, the attackers were able to gain a foothold inside the Continuous Integration and Continuous Deployment (CI/CD) pipelines of any project utilizing the tools. Once active, the malware was designed to perform a silent but devastating function: harvesting sensitive credentials. In the high-stakes environment of a modern software build, CI/CD pipelines often handle a wealth of "secrets," including API keys, cloud provider tokens, and private environment variables. The compromised "actions-cool" tools were observed exfiltrating these details to an attacker-controlled server, specifically utilizing the domain "t.m-kosche[.]com."

The technical community’s understanding of this threat was deepened by researchers at the security firm Socket, who linked the GitHub compromise to a broader campaign involving the npm package ecosystem. Specifically, overlaps were found between the infrastructure used in the GitHub Actions attack and malicious packages identified within the @antv ecosystem. Philipp Burckhardt, the head of threat intelligence at Socket, noted at the time that the evidence pointed to a unified activity cluster rather than a series of isolated incidents. This "Mini Shai-Hulud" group appeared to be running a sophisticated, multi-platform operation aimed at the heart of the software supply chain.