A major cybersecurity lapse has left thousands of developers vulnerable to malware, as two compromised GitHub Actions were re-enabled last week without proper cleaning. The actions in question, issues-helper and maintain-one-comment, had been disabled since May after being targeted by a sophisticated supply-chain attack known as Mini Shai-Hulud.
The Mini Shai-Hulud campaign infected 323 packages and 639 package versions on the Node Package Manager (npm) index with malware designed to steal developers’ tokens, credentials, and CI/CD secrets. Despite the initial removal of the compromised actions, they were re-enabled on September 16, allowing workflows that referenced them to download and execute the malicious payload.
According to researchers at Socket, a security company that discovered the issue, the two repositories became accessible again on September 16, with their release tags still pointing to the malicious content introduced in May. This meant that any workflow referencing either action by a version tag resumed downloading and executing the payload on its next run. It’s unclear why these repositories were re-enabled without proper cleaning occurring first.
The compromised actions are used for issue-housekeeping needs and run almost daily, supporting tasks such as maintaining one comment or helping with issues. However, Socket researchers note that they have not yet established how many dependents reference either action by mutable tag instead of a pinned commit. The dependency graph lists about 15,000 repositories depending on issues-helper, but it’s unclear how many were compromised.
Fortunately, both actions were disabled again on September 25, preventing further damage. However, potentially impacted developers should be on high alert and take immediate action to secure their workflows. According to Socket, the exposure started on September 16 between 11:09 and 18:16 GMT+2. Developers are advised to find references to both actions, remove them or pin a verified clean commit, review runs since September 16, and rotate secrets accessible to workflows that ran an affected tag.
This incident highlights the ongoing threat of supply-chain attacks and the importance of vigilance in maintaining secure development pipelines. It’s essential for developers to regularly review their dependencies, update their workflows, and implement robust security measures to prevent similar incidents in the future. By taking proactive steps to address these vulnerabilities, developers can protect themselves from malware and other cyber threats.
Source: Bleeping Computer — 2026-09-26