Full Report
Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this
Analysis Summary
# Incident Report: Re-compromise of actions-cool GitHub Actions
## Executive Summary
Two popular GitHub Actions maintained by `actions-cool` were disabled by GitHub for a second time following a resurgence of unauthorized access linked to the May 2026 "Mini Shai-Hulud" supply chain campaign. The incident highlights a failure in long-term remediation, as the repositories became vulnerable again months after the initial compromise, leading to their total removal from the platform.
## Incident Details
- **Discovery Date:** Late 2026 (Following re-accessibility last week)
- **Incident Date:** May 2026 (Original) / Re-emerged late 2026
- **Affected Organization:** actions-cool (GitHub maintainer)
- **Sector:** Software Development / Open Source Supply Chain
- **Geography:** Global (Open Source Community)
## Timeline of Events
### Initial Access
- **Date/Time:** May 2026
- **Vector:** Supply chain compromise via the "Mini Shai-Hulud" campaign.
- **Details:** Attackers gained unauthorized access to the `actions-cool` developer environment or credentials, allowing for the injection of malicious code into automated workflows.
### Lateral Movement
- **Details:** The compromise focused on the CI/CD pipeline, potentially moving from the repository maintainer's account to the environments of users who integrated these GitHub Actions into their own private and public repositories.
### Data Exfiltration/Impact
- **Details:** Potential exfiltration of `GITHUB_TOKEN` secrets and other environment variables from organizations utilizing the compromised actions.
### Detection & Response
- **Detection:** Repositories were flagged after becoming briefly accessible again following a period of suspension, indicating unresolved security issues.
- **Response actions taken:** GitHub issued a second, definitive shutdown of the repositories. Users visiting the pages now receive a 404/Access Denied message.
## Attack Methodology
- **Initial Access:** Compromised Maintainer Accounts / API Keys.
- **Persistence:** Malicious code embedded in version-controlled GitHub Action scripts.
- **Defense Evasion:** Leveraging trusted open-source repositories to bypass traditional perimeter security (Supply Chain Attack).
- **Collection:** Harvesting secrets and tokens during the execution of the Action in a runner environment.
- **Impact:** Code execution within the context of the user's GitHub repository.
## Impact Assessment
- **Financial:** Indirect costs related to incident response for all downstream users.
- **Data Breach:** High risk of secret/token exposure for users of `issues-helper` and `maintain-one-comment`.
- **Operational:** Disruption of CI/CD pipelines for thousands of developers relying on these automated tools.
- **Reputational:** Significant loss of trust in the `actions-cool` namespace and general concern regarding GitHub Action security.
## Indicators of Compromise
- **File indicators:** Modified `action.yml` or associated JavaScript distribution files within the `actions-cool/issues-helper` and `actions-cool/maintain-one-comment` repositories.
- **Behavioral indicators:** Unexpected outbound network connections from GitHub Runner environments to unknown C2 (Command & Control) servers during workflow execution.
## Response Actions
- **Containment:** GitHub disabled the `actions-cool` repositories to prevent further downloads or updates.
- **Eradication:** Removal of the malicious versions from the GitHub Marketplace.
- **Recovery:** Users must audit their workflows and replace the defunct actions with trusted alternatives.
## Lessons Learned
- **Remediation Persistence:** An incident is not closed just because a repository is hidden; persistent attackers may regain access if the underlying credential compromise (Mini Shai-Hulud campaign) isn't fully purged.
- **Supply Chain Vulnerability:** Heavy reliance on third-party GitHub Actions without pinning to specific commit SHAs (as opposed to tags) creates significant security debt.
## Recommendations
- **Pin Actions to Commit SHAs:** Instead of using `actions-cool/issues-helper@v3`, use the specific immutable commit hash to prevent automatic updates to malicious code.
- **Secret Rotation:** Any organization that used these actions between May 2026 and the present should immediately rotate all GitHub secrets and tokens.
- **Implement OIDC:** Use OpenID Connect (OIDC) for cloud authentication to avoid long-lived secrets in GitHub Actions environments.