Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

Restored Repositories Bring Back May's Malware Without a Cleanup

Two GitHub Actions published by the actions-cool maintainer — issues-helper and maintain-one-comment, both used to automate closing inactive issues and managing bot comments — have started executing malicious code again after being disabled for months. Researchers say the repositories were compromised in May 2026 as part of the broader Mini Shai-Hulud supply-chain campaign, then taken offline. When they were made accessible again on September 16, 2026, the malicious commits and release tags from May were never cleaned up — so any workflow still referencing the compromised versions by tag resumed pulling and executing the original credential-stealing payload on its next run.

Details

How the Payload Came Back Without New Code

Mini Shai-Hulud is a supply-chain campaign that has compromised multiple GitHub Actions and npm packages across the ecosystem, tied together by shared attacker infrastructure — most notably the exfiltration domain t.m-kosche[.]com, which researchers used to link this incident back to the same operators behind other May 2026 compromises. When GitHub or the maintainer restored public access to issues-helper and maintain-one-comment on September 16, the release tags still pointed at the malicious commits from the original compromise. Any CI/CD workflow that references these actions by version tag rather than a pinned commit SHA would, on its next scheduled or triggered run, transparently pull the same malware that was live back in May and execute it inside that workflow's environment — with no new attacker action required.

The payload's function hasn't changed: it harvests secrets and credentials available to the CI/CD job (API tokens, cloud credentials, npm publish tokens) and exfiltrates them to attacker-controlled infrastructure. Because GitHub Actions workflows routinely run with access to repository secrets and sometimes broader organizational credentials, a single reactivated dependency can expose far more than the repository it runs in.

Why This Matters

• Tag-based pinning is not sufficient — pinning to a version tag (e.g., @v3) rather than a commit SHA means a maintainer or platform action (like restoring a suspended repo) can silently change what code actually runs.
• A "disabled" compromise isn't a "fixed" one — repository suspension paused the attack but didn't remediate it; restoring access without auditing and rewriting history brought the malware back with zero new attacker effort.
• Blast radius extends beyond the two actions — any organization that adopted issues-helper or maintain-one-comment for routine repo housekeeping and never revisited that dependency is at risk of having quietly re-run the malicious workflow since September 16.

Recommendations

1. Search your workflows for any reference to actions-cool/issues-helper or actions-cool/maintain-one-comment across all repositories and branches.
2. Remove or replace those actions immediately; if continued use is required, pin to a commit SHA predating May 18, 2026 rather than a version tag, and verify that commit's contents.
3. Rotate all secrets accessible to any workflow that referenced these actions since September 16, 2026, including cloud credentials, npm/PyPI publish tokens, and internal API keys.
4. Audit workflow run history for unexpected successful executions or network calls to t.m-kosche[.]com or related infrastructure.
5. Adopt commit-SHA pinning as a standing policy for all third-party GitHub Actions, and consider tools that alert on Action dependency changes.

Key Takeaways

1. actions-cool/issues-helper and actions-cool/maintain-one-comment, compromised in the May 2026 Mini Shai-Hulud campaign, resumed executing their credential-stealing payload after being restored on September 16, 2026 without cleanup.
2. No new attacker activity was needed — workflows pinned to the version tag simply re-downloaded the still-malicious release.
3. The payload harvests CI/CD credentials and secrets, exfiltrating them to infrastructure linked to the wider Mini Shai-Hulud cluster.
4. Organizations using either action should rotate secrets, audit workflow history, and pin actions to a clean commit SHA rather than a tag.

Sources

• Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware — The Hacker News