Compromised GitHub Actions Came Back Online and Resumed Executing Malware

Two GitHub Actions maintained by actions-cool have been disabled for a second time, after their repositories briefly became accessible again on September 16, 2026, months after they were compromised in the May 2026 Mini Shai-Hulud campaign, The Hacker News reported.

Both repositories now show a notice that GitHub Staff disabled access over a violation of GitHub's terms of service. The affected actions are actions-cool/issues-helper and actions-cool/maintain-one-comment.

What happened

Both actions were first compromised on May 18, 2026, to run malicious code inside the CI/CD pipelines that used them. That code harvested sensitive credentials from the build environment and sent them to an attacker-controlled server.

Socket researcher Karlo Zanki said the repositories became accessible again on September 16, 2026, between 11:09 a.m. and 6:16 p.m. GMT+2; why is still unknown. "Their release tags were not cleaned up first," he said. "They still point to the malicious content introduced on May 18, so any workflow that references either action by a version tag resumed downloading and executing the payload on its next run."

Both actions automate routine issue and comment housekeeping, such as closing inactive issues or keeping a bot comment up to date. Such workflows usually run daily or when an issue or pull request is opened, so most affected repositories likely ran the payload within a day of the re-enablement, without further action by the attackers.

Why it matters

The activity has been linked to the Mini Shai-Hulud cluster, based on overlaps in the exfiltration domain ("t.m-kosche[.]com") also used by malicious npm packages in the @antv ecosystem.

Workflows that pin either action to the full commit SHA of a pre-May 18, 2026 version are not affected. "Most supply chain incidents involve something new," Zanki said. "This one did not. No new code was published and no configuration was changed."

Socket says the case shows that a mutable tag can be compromised and then reactivated without any change to the workflow file, and that SHA pinning removes that dependency on the upstream repository.

What developers should do

Socket recommends locating every reference to the affected actions and treating actions-cool/[email protected] as compromised, removing them and pinning to a known-clean SHA from before May 18, 2026, and rotating all exposed secrets. Teams should also watch for newly successful runs after long "Set up job" failures and audit repositories for unexpected commits after September 16, 2026.