Introduction

GitHub Actions, a powerful tool for automating workflows in GitHub repositories, has recently fallen victim to a supply-chain attack known as the Mini Shai-Hulud. Two previously compromised GitHub Actions, actions-cool/issues-helper and actions-cool/maintain-one-comment, were re-enabled by their maintainers and remained active for over a week, allowing them to download and execute a malicious payload. Despite efforts to remove them, the actions continued to point to the malicious code, highlighting the ongoing threat posed by such attacks.

GitHub Actions re-enabled with Mini Shai-Hulud payload still active

The Attack Overview

On May 18, the GitHub security team detected that actions-cool/issues-helper and actions-cool/maintain-one-comment had been compromised in a Mini Shai-Hulud campaign. The security team promptly removed these actions from the repository, preventing any downstream workflows from downloading malware. However, the actions were re-enabled by their maintainers, and they remained active until September 25, 2026.

The Impact of the Attack

The Mini Shai-Hulud supply-chain attack affected 323 packages and 639 package versions on the Node Package Manager (npm) index, infecting them with malware that targets developers’ tokens, credentials, and CI/CD secrets. The Socket researchers found that the release tags for actions-cool/issues-helper and actions-cool/maintain-one-comment resolved to a commit containing the obfuscated payload inside the index.js file on September 16, 2026.

Why Were These Actions Re-enabled?

It is unclear why these repositories were re-enabled without proper cleaning occurring first. The GitHub dependency graph lists about 15,000 repositories depending on issues-helper, though not all of them were compromised. The Socket researchers note that they have not yet established how many dependents reference either action by mutable tag instead of a pinned commit. However, they explain that the impacted actions are those running almost daily, as they support issue-housekeeping needs.

Mitigation Steps

To mitigate the risk of the Mini Shai-Hulud attack, developers should take the following steps:

  1. Find and Remove References: Look for references to both actions and remove them or pin a verified clean commit.
  2. Review Runs: Review runs since September 16, 2026, to ensure that the malicious payload is not being executed.
  3. Rotate Secrets: Rotate secrets accessible to workflows that ran an affected tag.

Conclusion

The Mini Shai-Hulud supply-chain attack highlights the importance of maintaining a robust security posture in the development ecosystem. Developers should stay vigilant and take proactive steps to prevent such attacks from occurring. If you are a developer or IT professional, it is crucial to ensure that your repositories are secure and to stay updated with the latest security measures.

Related Threats

  • GitHub Actions Compromised Again: This article discusses the re-enabling of compromised GitHub Actions, which continued to point to malicious code for over a week.
  • Hijacking cPGuard to Deploy Backdoor and Steal Data: This article describes how hackers hijacked the cPGuard autoupdate to deploy a backdoor and steal data.
  • QNAP Hack Reveals Breaches in NAS Devices: This article discusses the QNAP hack that led to the deployment of malware in NAS devices.
  • SonicWall SSL-VPN MFA Bypass Flaw: This article highlights a new SSL-VPN MFA bypass flaw that has been exploited in attacks.
  • Password Health-Check Audit: This article offers a free audit of your Active Directory to ensure password hygiene.
  • CTM360 for External Risk Monitoring: This article introduces a tool for monitoring, analyzing, and mitigating risks across your external digital landscape.
  • Cape: Privacy-First Mobile Carrier: This article promotes a privacy-first mobile carrier option for users.
  • Workspace Risk Index: This article provides insights into what AI can read in the Workspace Risk Index.
  • Detection Coverage and Gaps: This article discusses the importance of monitoring and analyzing detection coverage to identify gaps and fund the necessary improvements.
  • GPT-6 Cyber AI and Firefox Bugs: This article highlights the findings of a new GPT-6 Cyber AI that discovered 81 Firefox flaws and 948 Linux bugs.
  • Hugging Face Malware Campaign: This article describes a malware campaign that used Hugging Face to distribute malware.
  • Fake Security Tools on GitHub: This article discusses the use of fake security tools on GitHub to push backdoors and infostealers.
  • NIKKE PC Game Launcher Hack: This article describes a hack of the NIKKE PC game launcher that spread remote access and data-stealing malware.
  • SonicWall SSL-VPN MFA Bypass Flaw: This article highlights a new SSL-VPN MFA bypass flaw that has been exploited in attacks.
  • Overdue Password Health-Check Audit: This article offers a free audit of your Active Directory to ensure password hygiene.
  • CTM360 for External Risk Monitoring: This article introduces a tool for monitoring, analyzing, and mitigating risks across your external digital landscape.
  • Cape: Privacy-First Mobile Carrier: This article promotes a privacy-first mobile carrier option for users.
  • Workspace Risk Index: This article provides insights into what AI can read in the Workspace Risk Index.
  • Detection Coverage and Gaps: This article discusses the importance of monitoring and analyzing detection coverage to identify gaps and fund the necessary improvements.
  • Hugging Face Malware Campaign: This article describes a malware campaign that used Hugging Face to distribute malware.
  • Fake Security Tools on GitHub: This article discusses the use of fake security tools on GitHub to push backdoors and infostealers.
  • NIKKE PC Game Launcher Hack: This article describes a hack of the NIKKE PC game launcher that spread remote access and data-stealing malware.
  • SonicWall SSL-VPN MFA Bypass Flaw: This article highlights a new SSL-VPN MFA bypass flaw that has been exploited in attacks.
  • Overdue Password Health-Check Audit: This article offers a free audit of your Active Directory to ensure password hygiene.
  • CTM360 for External Risk Monitoring: This article introduces a tool for monitoring, analyzing, and mitigating risks across your external digital landscape.
  • Cape: Privacy-First Mobile Carrier: This article promotes a privacy-first mobile carrier option for users.
  • Workspace Risk Index: This article provides insights into what AI can read in the Workspace Risk Index.
  • Detection Coverage and Gaps: This article discusses the importance of monitoring and analyzing detection coverage to identify gaps and fund the necessary improvements.

Keywords

Comments