Two popular GitHub Actions have been temporarily restored to working order, although their release tags still point to malicious Mini Shai-Hulud. The report concerned workflows that downloaded actions with a release tag instead of a verified commit SHA.
The Socket discovered that the actions-cool/issues-helper and actions-cool/maintain-one-comment became accessible again on September 16, 2026. Their tags had not been cleaned up and were still pointing to the payload that had been introduced in May.
See also: The Shai-Hulud attack on an AI coding assistant session
How Mini Shai-Hulud was reactivated
Both actions were compromised on May 18. GitHub's security team disabled them, causing workflows to fail before downloading code. When the repositories were made available again, however, the old tags allowed workflows that used versions to continue from the same malicious point.
The exposure began in a time window between 11:09 and 18:16 GMT+2 on September 16. Researchers do not know why the repositories were reactivated without first removing the malicious code. Thus, a scheduled build or new issue could re-execute the payload without changing the local feed file.
According to BleepingComputer, the release tags pointed to a commit with a hidden payload inside the index.js. The action could extract credentials, access tokens, and secrets that were available in the CI/CD environment.
issues -helper is used for automation on issues, while maintain-one-comment manages comments on repositories. These operations are often performed daily or when an issue or pull request is opened. Socket estimates that around 15,000 repositories are shown as dependent on the first action, but this does not mean that all of them were violated.
What it means for workflows
The problem mainly affects references like actions-cool/issues-helper@v2.2.1, because the tag can move and point to a different commit. In contrast, a reference to a verified full SHA commit from before May 18th is not affected by the change in repository availability.
On September 25th, GitHub disabled both actions again. Flows that call them now fail at the initialization stage, rather than executing the payload. This limits immediate exposure, but does not eliminate the possibility that code was executed during the re-enablement interval.
Timing is especially important because automation for issues and comments often operates without human intervention. A repository that did not receive a new pull request could still trigger the action via a scheduled task. This makes it difficult to detect, as the execution was not necessarily accompanied by a change to the source code.
The availability of the action does not in itself prove a breach of an organization. However, a successful execution with access to secrets should be treated as a possible incident. Looking at logs, outbound connections, and permission changes can indicate whether there has been unauthorized use.
See also: PhantomRaven: The AI-Built npm Stealer
Direct checks with SHA commits
Development teams should search every .github/workflows/ for both references and consider any use of the tag suspicious. The safest option is to remove the actions or replace them with a commit SHA that has been audited and is from before the initial breach.
Executions from September 16 onwards are being audited. Special attention should be paid to successful executions that occurred after consecutive errors in the “Set up job” stage. If a flow had access to secrets, administrators should revoke and replace them, along with cloud credentials and package registries.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The SecNews technical team also recommends checking the repository history for unexpected commits after September 16. Re-enabling a dependency without a new change to the code shows why tags are not enough to secure a software chain.
See also: TeamCity: The risks for development chains
The Mini Shai-Hulud is a reminder that disabling an action is not enough if old tags and permissions remain available. Moving to SHA-verified commits, limited stream access, and timely secret rotation significantly reduce the likelihood of a recurrence.
