Compromised GitHub Actions Re-Enabled With Active Mini Shai-Hulud Malware Intact

Two third-party GitHub Actions previously compromised in the May Mini Shai-Hulud campaign were mistakenly re-enabled by their maintainer for over a week. Security firm Socket discovered the actions-cool/issues-helper and maintain-one-comment repositories were active from September 16 to September 25. The repositories were restored using their original release tags, which still resolved to a commit containing the obfuscated malicious payload in the ‘index.js’ file. GitHub’s dependency graph lists about 15,000 repositories depending on the issues-helper action, which is widely used for almost daily issue-housekeeping workflows. The original Mini Shai-Hulud supply-chain attack affected 323 packages and 639 versions on the npm index, explicitly targeting developers’ tokens, credentials, and CI/CD secrets. “On September 16, 2026, both repositories became accessible again. Their release tags were not cleaned up first.” — Socket