Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud

Two GitHub Actions, actions-cool/issues-helper and actions-cool/maintain-one-comment, which were compromised during the May 2026 Mini Shai-Hulud campaign, were reportedly made accessible again on September 16 while their version tags still referenced malicious code. Because thousands of downstream repositories use these actions through mutable tags rather than fixed commit SHAs, routine scheduled or issue-triggered workflows could automatically download and execute the payload, potentially exposing workflow tokens and secrets. Evidence from workflow histories showed jobs changing from immediate setup failures while the repositories were disabled to multi-minute successful runs after re-enablement, including downloads of Bun and execution of suspicious scripts. GitHub disabled both actions again by September 25, causing dependent workflows to fail during setup rather than run the payload. The report emphasizes that restoring access to previously compromised repositories without cleaning malicious tags can reactivate an old supply-chain incident, and recommends identifying affected workflows, removing or SHA-pinning the actions to verified clean commits, rotating accessible secrets, reviewing logs and repository history, and pinning all third-party GitHub Actions by full commit SHA.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.