Compromised GitHub Actions brought back online with malware still attached

Researchers at application security firm Socket have found that two previously compromised GitHub Actions became accessible again — still carrying the malicious code they had been serving before, and continued to do so for more than a week.

The actions in question are actions-cool/issues-helper and actions-cool/maintain-one-comment. Both were compromised on May 18 as part of the Mini Shai-Hulud campaign, after which GitHub's security team removed the repositories to stop any downstream workflow from downloading the malware.

Back online, uncleaned

According to Socket, between September 16 and 25 the two actions came back to life — with the same release tags still pointing to a commit that held an obfuscated payload inside the index.js file. As a result, any workflow that referenced an action by version tag resumed downloading and executing the old malicious code on its next run.

"On September 16, 2026, both repositories became accessible again. Their release tags were not cleaned up first," Socket explained. Exactly why the repositories were re-enabled without proper cleanup remains unclear. The precise exposure window was September 16, from 11:09 to 18:16 GMT+2.

Scale

May's Mini Shai-Hulud supply-chain attack hit 323 packages and 639 package versions on the npm index, infecting them with malware that targets developers' tokens, credentials, and CI/CD secrets.

GitHub's dependency graph lists roughly 15,000 repositories depending on issues-helper, though that does not mean all of them were compromised. The researchers have not yet established how many dependents reference either action by a mutable tag rather than a pinned commit. They note, however, that the affected actions run almost daily, since they support routine issue-housekeeping tasks.

On September 25, Socket found both actions disabled again on GitHub, causing workflows that reference them to fail rather than run the payload.

What to do

Socket recommends locating all references to both actions and either removing them or pinning a verified clean commit, reviewing runs since September 16, and rotating any secrets accessible to workflows that ran an affected tag.

Source: Bleeping Computer