GitHub Re-Enables Compromised Actions, Reactivating Mini Shai-Hulud Malware

Two GitHub Actions from the actions-cool organization were disabled for a second time after their repositories became accessible again, months after they were compromised during the May 2026 Mini Shai-Hulud campaign.

The affected GitHub Actions are:

  • actions-cool/issues-helper
  • actions-cool/maintain-one-comment

Both repositories are currently disabled by GitHub for violating its terms of service.

Malicious Code Was Still Present

The two GitHub Actions were originally compromised on May 18, 2026.

The malicious code was designed to execute inside CI/CD workflows, collect sensitive credentials, and send the stolen information to attacker-controlled infrastructure.

The activity was linked to the Mini Shai-Hulud campaign based on infrastructure overlaps, including the exfiltration domain t.m-kosche[.]com.

On September 16, 2026, both repositories temporarily became accessible again.

However, their release tags had not been cleaned. The tags still pointed to malicious code introduced during the May compromise.

As a result, workflows referencing the affected actions through version tags could automatically download and execute the malicious payload when they ran again.

No New Attack Was Required

The reactivation did not require attackers to publish new malicious code or modify existing victim workflows.

Affected workflows could automatically execute the old payload when triggered by:

  • Scheduled jobs
  • New issues
  • Pull requests
  • Other workflow events

Because these actions are commonly used for issue and comment management, many affected repositories may have executed the malicious code shortly after the repositories became accessible again.

Why Mutable Tags Are a Risk

The incident highlights the risks of relying on mutable GitHub Action version tags.

A workflow referencing a tag such as:

actions-cool/[email protected]

can receive whatever code that tag currently points to.

Even if a malicious repository is temporarily disabled, re-enabling it can make the previously compromised tag available again if the malicious code was not removed.

Workflows pinned to a specific commit SHA from before May 18, 2026 are not affected by this particular reactivation.

Developers using these GitHub Actions should:

  1. Search repositories for references to the affected actions.
  2. Treat actions-cool/[email protected] as compromised.
  3. Remove the affected actions or pin them to a known-clean commit SHA that predates May 18, 2026.
  4. Rotate secrets that may have been exposed.
  5. Review GitHub Actions workflow history for unexpected successful runs.
  6. Investigate repositories where workflow jobs began succeeding after a prolonged period of setup failures.
  7. Review repository history for unexpected commits after September 16, 2026.

Organizations should also review other third-party GitHub Actions and prefer full commit SHA pinning over mutable version tags.

Key Takeaway

This incident demonstrates that a previously compromised GitHub Action can become dangerous again without a new malicious release or changes to a victim's workflow.

Using immutable commit SHA references can prevent a workflow from automatically receiving a different version of an action when an upstream repository or tag changes.