GitHub Actions Compromised in ‘Mini Shai-Hulud’ Attack Disabled Again Following Brief Reappearance

The cybersecurity landscape has been reminded once again of the persistent and often "zombie-like" nature of supply chain threats. In a development that has raised significant questions regarding the cleanup and remediation protocols of major development platforms, two popular GitHub Actions associated with the "actions-cool" organization were disabled for a second time last week. This administrative intervention by GitHub staff followed a brief and unexplained window during which the repositories became accessible to the public, despite having been identified months earlier as vehicles for malicious code during the significant "Mini Shai-Hulud" supply chain campaign of May 2026.

The incident highlights a critical gap in how compromised open-source assets are managed after an initial breach is detected. While the repositories were originally taken offline in the wake of the spring attacks, their sudden reappearance on September 16, 2026, occurred without the necessary removal of the malicious components. Because the underlying codebases remained tainted, any developer or organization whose automated workflows were still configured to call upon these actions was immediately placed at risk of data theft and pipeline compromise the moment the repositories were set back to "public" status.

The history of this specific threat dates back to May 18, 2026, a period that marked the height of the Mini Shai-Hulud activity cluster. During this time, threat actors successfully compromised the workflows of several GitHub Actions designed to assist maintainers with repository housekeeping. These tools, which automate tasks such as closing inactive issues, managing bot-generated comments, and triaging new pull requests, are widely used across the GitHub ecosystem to reduce the manual burden on software developers. However, the very automation that makes them valuable also makes them an ideal delivery mechanism for malware.

By injecting malicious code into these actions, the attackers were able to gain a foothold inside the Continuous Integration and Continuous Deployment (CI/CD) pipelines of any project utilizing the tools. Once active, the malware was designed to perform a silent but devastating function: harvesting sensitive credentials. In the high-stakes environment of a modern software build, CI/CD pipelines often handle a wealth of "secrets," including API keys, cloud provider tokens, and private environment variables. The compromised "actions-cool" tools were observed exfiltrating these details to an attacker-controlled server, specifically utilizing the domain "t.m-kosche[.]com."

The technical community’s understanding of this threat was deepened by researchers at the security firm Socket, who linked the GitHub compromise to a broader campaign involving the npm package ecosystem. Specifically, overlaps were found between the infrastructure used in the GitHub Actions attack and malicious packages identified within the @antv ecosystem. Philipp Burckhardt, the head of threat intelligence at Socket, noted at the time that the evidence pointed to a unified activity cluster rather than a series of isolated incidents. This "Mini Shai-Hulud" group appeared to be running a sophisticated, multi-platform operation aimed at the heart of the software supply chain.

After the initial discovery in May, the affected repositories were disabled by GitHub to prevent further damage. However, the events of September 16, 2026, suggest that the containment was only temporary and lacked a thorough sanitization of the source material. According to Socket researcher Karlo Zanki, the repositories became accessible again for a period of approximately seven hours, between 11:09 a.m. and 6:16 p.m. GMT+2. The reason for this temporary restoration of access remains unclear, but the consequences were immediate.

The primary issue lay in the fact that the release tags for the actions were never cleaned. In the world of GitHub Actions, developers typically reference a specific version of a tool using a tag, such as "v1" or "v1.2.3." These tags are mutable, meaning they can be moved to point to different commits in the repository’s history. When the "actions-cool" repositories were re-enabled, these version tags still pointed to the malicious commits introduced by the attackers back in May. Consequently, any automated workflow that was set to run on a schedule or triggered by an event—such as a new pull request—would have automatically downloaded and executed the payload upon its next run.

This "reactivation" of a months-old threat is particularly concerning because it required no new effort from the original attackers. There was no need for a new exploit, no requirement to hijack new accounts, and no necessity to set up fresh infrastructure. The threat was essentially "baked in" to the repository, waiting for the moment it became downloadable once more. Because the housekeeping actions are designed to run frequently—often daily or even hourly—the window of exposure was more than enough time for the malware to execute in thousands of environments.

The incident serves as a stark warning about the dangers of relying on mutable version tags in software development. As Karlo Zanki observed, most supply chain incidents involve a "new" element—a fresh piece of malware, a newly stolen credential, or a sudden change in configuration. In this case, the danger was entirely historical. The fact that a compromised tag can be contained and then reactivated without any change to a user’s own workflow file underscores the fragility of the current trust model in open-source automation.

To mitigate such risks, security experts have long advocated for the practice of "SHA pinning." Instead of referencing a GitHub Action by a version tag like "v2," developers are encouraged to use the full, immutable commit SHA (a long string of characters representing a specific, unchangeable snapshot of the code). While version tags can be moved to point to malicious code, a commit SHA is permanent. If a repository is compromised and a tag is moved, a workflow pinned to a SHA will continue to use the known-good version of the code from before the breach occurred.

For those currently using GitHub Actions for repository management, the recommendation is clear: audit all external actions and ensure they are pinned to specific commit hashes rather than version tags. Additionally, any organization that may have run the "actions-cool" tools during the brief window of exposure on September 16 should treat their CI/CD secrets as potentially compromised. This involves rotating API keys, changing tokens, and reviewing access logs for any unusual activity originating from their build environments.

The recurrence of the Mini Shai-Hulud threat also places a spotlight on the responsibilities of platform providers like GitHub. While the swift second disabling of the repositories prevented a longer-term catastrophe, the fact that they were allowed to return to a public state while still containing malicious release tags suggests a need for more robust "tombstoning" procedures. When a repository is flagged for a security violation of this magnitude, the process for re-enabling it must involve a rigorous verification that all malicious artifacts have been purged from the version history.

As the industry continues to move toward more automated and interconnected development workflows, the surface area for supply chain attacks continues to expand. The "actions-cool" incident demonstrates that even "minor" tools—those that simply manage comments or clean up old issues—can become high-value targets if they are granted permissions to run within sensitive environments. The ability of the Mini Shai-Hulud actors to harvest credentials through such innocuous-seeming tools is a testament to the creativity of modern threat actors.

Ultimately, this second disabling of the compromised actions serves as a reminder that in the realm of cybersecurity, "gone" does not always mean "deleted." Threats can lie dormant in the version history of a repository, waiting for a lapse in administrative oversight or a mistake in repository management to resurface. For developers, the lesson is one of constant vigilance and a shift toward more defensive coding practices, such as SHA pinning, to insulate their projects from the unpredictable lifecycle of upstream dependencies. The software supply chain is only as strong as its weakest link, and as this incident proves, sometimes that link is a tool that was thought to have been neutralized months ago.