In a worrying turn for software supply chain security, two GitHub Actions that were previously disabled after a compromise in May 2026 have been reactivated — and with them, the malicious Mini Shai-Hulud payload began executing again. The two workflows in question, actions-cool/issues-helper and actions-cool/maintain-one-comment, surfaced online around September 16, 2026. Despite being shut down in the spring, their release tags still pointed to tainted code, allowing any workflow referencing them to download and activate malware without any new updates or changes.
What Was the Original Breach?
Back in May 2026, these GitHub Actions were modified so that when run, they extracted sensitive credentials from CI/CD pipelines and sent them to an attacker’s server. This activity was traced to the Mini Shai-Hulud threat group, which had also compromised npm packages under the @antv namespace. The same exfiltration domains were used in both the GitHub and npm attacks, indicating a shared operation rather than isolated incidents.
Re-enablement & Renewed Risk
The two compromised repositories, disabled for violating GitHub’s terms, were unexpectedly restored in mid-September. Release tags, which were never cleaned up or updated, still pointed to the malicious payloads introduced in May. As workflow runs automatically fetch tags unless pinned to a version specified by commit SHA, many repositories started executing the malware again—some presumably within a day of reactivation—without the attacker taking new steps.
Security Consequences and Mitigation Steps
This incident highlights the danger of relying on mutable version tags. When tags reference malicious content, reactivation of a disabled upstream component can trigger a full supply chain breach again. Repositories that reference actions-cool/[email protected] or similarly tagged versions need immediate attention.
Experts recommend taking these urgent actions: locate all workflows using the affected actions, replace them or pin to a clean SHA from before May 18, 2026; rotate any secrets that may have been exposed; analyze recent workflow execution logs for unexpected successful runs; and inspect the repos’ history for any unauthorized changes after the September reactivation event.
The Mini Shai-Hulud resurgence shows that not all supply chain threats emerge from fresh exploit chains. Even dormant malicious code can reopen vulnerabilities when previously disabled components are reactivated. This move underscores the significance of immutable dependencies—and the dangers of version tags that remain unstable.
What this means moving forward: Organizations need to prioritize pinning dependencies by commit SHA, enforce stricter auditing of external Actions and packages, and monitor for unexpected workflow successes—especially following repository state changes or reinstatements. The next big compromise may just be a reactivation away.
