Two GitHub Actions known as actions-cool were once again disabled after briefly becoming accessible last week. These repositories, originally compromised in the Mini Shai-Hulud campaign of May 2026, were re-enabled, raising concerns in the cybersecurity community.
Re-activation of Compromised Repositories
Last seen online on September 16, 2026, these repositories were not cleansed of their malicious content before becoming accessible again. This allowed workflows referencing specific version tags to inadvertently download and execute harmful payloads. Karlo Zanki, a researcher at Socket, highlighted the issue, noting that the release tags were unchanged, facilitating the resumption of malware execution.
The original compromise of these GitHub Actions involved the execution of malicious code that aimed to gather sensitive credentials from CI/CD pipelines. This data was then transmitted to a server controlled by the attackers. The attack was traced back to the Mini Shai-Hulud activity cluster, characterized by shared exfiltration domains and links to npm packages from the @antv ecosystem.
Potential Risks and Developer Guidance
The reactivation of these repositories without proper cleanup suggests significant risks for software supply chain security. The malicious code remained intact, and the only requirement for its activation was for the repositories to be downloadable once more. The compromised Actions were primarily used for automating tasks such as managing issues and comments in repositories, potentially impacting many workflows.
Developers are advised to take immediate action to mitigate these risks. They should identify all references to the affected actions, replace them with clean SHAs predating May 18, 2026, and rotate any exposed secrets. Additionally, auditing the workflow run history for unusual activity and reviewing repository history for unexpected changes after September 16, 2026, are crucial steps in securing their environments.
Understanding the Implications
Unlike typical supply chain attacks, this incident lacked new code or configuration changes. Instead, it underscores the vulnerability of mutable tags in workflows. As Zanki pointed out, the ability to reactivate compromised code without altering a workflow highlights the importance of SHA pinning to prevent such dependencies on the state of upstream repositories.
The resurfacing of the Mini Shai-Hulud malware serves as a critical reminder for developers and organizations to maintain vigilance and adopt best practices in securing their software supply chains. Ensuring robust security measures can mitigate the risks posed by similar incidents in the future.
