Compromised GitHub Actions Came Back Online to Spread Mini Shai-Hulud Malware

Two GitHub Actions repositories operated by actions-cool were disabled a second time after the accounts became accessible, months after being initially compromised during the May 2026 Mini Shai-Hulud campaign. The affected projects—issues-helper and maintain-one-comment—had already been flagged as malicious and taken offline, but when access returned, the malware resumed execution through workflows that depend on these actions. Repositories that had pulled these actions as dependencies were at risk of running compromised code without realizing the underlying tool had been reactivated.

GitHub Actions are automation scripts that developers embed into their CI/CD pipelines. When a project lists an action as a dependency, every workflow run pulls the code directly from the source repository. If that source repository is compromised, the malicious code runs with the same permissions as the workflow that called it. The attacker does not need to compromise each downstream project individually; compromising one popular action infects all projects that use it. Mini Shai-Hulud malware specifically targets this pattern by hiding malicious payloads in trusted development tools that appear legitimate at first glance.

GitHub repositories can be restored or re-accessed for several reasons: account credentials may be recovered or reset by the owner, the service may restore access after a security incident is supposedly resolved, or archived repositories may be temporarily re-enabled for maintenance. In this case, the actions-cool accounts became accessible again without the repository owners auditing what code was present before re-enabling access. This created a window where the original malware remained in place, ready to execute when downstream projects triggered workflows that called these actions.

Developers who had integrated issues-helper or maintain-one-comment into their repositories did not necessarily know the tools had been compromised. Their workflows would silently run the malicious code every time a pull request was opened, an issue was created, or a scheduled task ran. In one realistic scenario, a team using maintain-one-comment to auto-update comments in pull reviews would unknowingly grant the malware access to their build system, GitHub tokens, and potentially secrets stored in environment variables. The compromise persists across every CI/CD run until the developer manually audits and removes the action.

Check your GitHub repositories for any workflow files that reference actions-cool actions or other third-party tools. These are typically found in the .github/workflows directory as YAML files. Search for any references to actions-cool/issues-helper or actions-cool/maintain-one-comment and remove those action calls. After removing the actions, review what permissions those workflows had and consider rotating any GitHub tokens or secrets that were in scope during the time the action was active. Audit the git history of your repositories to see when these actions were added and whether any unexpected commits or deployments occurred around the same time the malware was active.

The steps to remediate are:

1. Open the .github/workflows directory in your main branch
2. Open each YAML file and search for "actions-cool" or the specific action names
3. Delete or comment out any lines that reference the compromised actions
4. Commit the changes and push to your repository
5. Review your GitHub token permissions and revoke any tokens that were active during the compromise period
6. Check your repository's activity log for unexpected commits or push events

This incident exposes a fundamental problem: developers must trust thousands of upstream dependencies, but the maintainers of those projects may lose control of their accounts, or the projects themselves may become targets for long-term compromise. A single compromised action can affect hundreds or thousands of downstream projects without those developers knowing. The Mini Shai-Hulud campaign demonstrated that attackers are willing to compromise developer tools and wait for the right moment to activate the malware, betting that security monitoring will eventually stop after the initial incident appears to be resolved.

The concrete lesson is this: do not assume that a GitHub Action or third-party tool remains safe just because it was removed from a security notice months ago. If you use any external actions in your CI/CD pipelines, verify them now. Check your workflow files, identify which actions you depend on, and research whether any of them have been compromised. If a project you use appears offline or was previously flagged as malicious, do not pull from it even if access becomes available again; replace it with a maintained alternative or fork it to your own account where you control the code. Treat developer tools with the same scrutiny you would apply to any code running in production.