Full Report
Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. [...]
Analysis Summary
# Incident Report: Mini Shai-Hulud GitHub Actions Re-infection
## Executive Summary
Two previously compromised third-party GitHub Actions (`actions-cool/issues-helper` and `actions-cool/maintain-one-comment`) were re-enabled by their maintainer despite still containing malicious code from the May 2024 "Mini Shai-Hulud" campaign. This oversight allowed the malicious payload to be executed in downstream CI/CD workflows for nine days. The impact includes the potential theft of developer credentials and CI/CD secrets across thousands of dependent repositories.
## Incident Details
- **Discovery Date:** September 18, 2026 (Reported by Socket)
- **Incident Date:** September 16, 2026 – September 25, 2026
- **Affected Organization:** Open-source maintainers and downstream users of `actions-cool`
- **Sector:** Technology / Software Development (Supply Chain)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** May 18, 2024 (Original Compromise)
- **Vector:** Repository Compromise (Maintainer account takeover or similar)
- **Details:** Attackers injected an obfuscated payload into `index.js` across multiple GitHub Actions.
### Lateral Movement
- **Details:** The malware targets CI/CD secrets and developer tokens to facilitate further access into private environments or other repositories.
### Data Exfiltration/Impact
- **Impact:** Potential theft of Node Package Manager (npm) tokens, GitHub personal access tokens (PATs), and environment secrets stored in GitHub Actions.
### Detection & Response
- **May 2024:** GitHub Security Team initially disabled the repositories.
- **September 16, 2026:** The maintainer re-enabled the repositories; however, release tags still pointed to the malicious May 18 commits.
- **September 25, 2026:** Researchers at Socket identified the reactivation; GitHub subsequently disabled the repositories again.
## Attack Methodology
- **Initial Access:** Supply Chain Compromise (Trusted third-party GitHub Action).
- **Persistence:** Malicious code embedded in version tags (e.g., v1, v2) that users automatically pull.
- **Defense Evasion:** Use of obfuscated JavaScript payloads in `index.js`.
- **Credential Access:** Targeting CI/CD secrets, developer tokens, and environmental variables.
- **Impact:** Execution of unauthorized code in the context of the victim's build environment.
## Impact Assessment
- **Financial:** N/A (Not disclosed)
- **Data Breach:** Exposure of secrets for potentially 15,000+ dependent repositories.
- **Operational:** Disruption to CI/CD pipelines (first by the malware, then by the disabling of the actions).
- **Reputational:** Loss of trust in third-party action maintainers and GitHub's repository restoration process.
## Indicators of Compromise
- **File indicators:** Obfuscated payload in `index.js` within `actions-cool/issues-helper` and `actions-cool/maintain-one-comment`.
- **Behavioral indicators:** GitHub Actions workflows making unexpected outbound connections or accessing secrets unrelated to issue management.
## Response Actions
- **Containment:** GitHub disabled the affected repositories on September 25, 2026.
- **Eradication:** Recommendation to remove references to the actions or pin to a known-safe commit hash.
- **Recovery:** Secret rotation for all impacted GitHub environments.
## Lessons Learned
- **Restoration Risk:** Re-enabling a compromised repository without a full security audit of existing tags/releases is a critical failure.
- **Mutable Tags:** The use of mutable tags (e.g., `@v2`) instead of immutable SHA-1 commit hashes allows malicious updates to be pulled automatically.
- **Dependency Awareness:** Organizations often lack visibility into the security posture of the third-party actions they integrate into their pipelines.
## Recommendations
- **Pin Actions by Commit Hash:** Use full SHA-1 hashes (e.g., `actions-cool/issues-helper@ [commit-hash]`) instead of version tags.
- **Secret Rotation:** Immediately rotate any secrets (AWS keys, NPM tokens, GitHub PATs) that were accessible to workflows using these actions between September 16 and 25.
- **Audit Workflows:** Implement automated tools (like Socket or GitHub's dependency graph) to monitor for known malicious dependencies in CI/CD configurations.