GitHub’s Reenabled Actions Expose Thousands to Mini Shai-Hulud Malware
In a concerning turn of events, two previously compromised GitHub Actions have been reenabled, allowing malicious code to be downloaded and executed by workflows referencing these actions. This lapse in security has left thousands of developers vulnerable to the same type of attack that infected over 600 package versions on the Node Package Manager (npm) index earlier this year.
The affected actions, issues-helper and maintain-one-comment, were compromised in May as part of a supply-chain attack dubbed Mini Shai-Hulud. At the time, GitHub’s security team removed these actions to prevent further malicious activity. However, researchers at application security company Socket discovered that on September 16, the release tags for these actions resolved to a commit containing obfuscated payload inside an index.js file. This meant that any workflow referencing either action by a version tag resumed downloading and executing the malware on its next run.
The implications of this exposure are significant, as about 15,000 repositories depend on issues-helper. While it’s unclear how many of these repositories were compromised, Socket notes that the impacted actions support issue-housekeeping needs, which means they run almost daily. This increases the likelihood of workflows being affected by the malicious code.
On September 25, just over a week after the reenabled actions went live, Socket found that both issues-helper and maintain-one-comment had been disabled again on GitHub. This move prevented further workflows from running the payload, but it’s unclear why these repositories were reenabled without proper cleaning occurring first.
The Mini Shai-Hulud attack in May infected 323 packages and 639 package versions on npm, with malware targeting developers’ tokens, credentials, and CI/CD secrets. The reenabled actions pose a similar threat to thousands of developers who may be unaware that their workflows are referencing these compromised actions.
To mitigate this risk, Socket recommends that potentially impacted developers review their workflow runs since September 16 and remove any references to the affected actions or pin a verified clean commit. Additionally, they should rotate secrets accessible to workflows that ran an affected tag.
In conclusion, this incident highlights the importance of vigilance in maintaining secure development practices. As the threat landscape continues to evolve, it’s essential for developers and security teams to stay informed about potential vulnerabilities and take proactive steps to protect themselves from supply-chain attacks like Mini Shai-Hulud.
Source: Bleeping Computer — 2026-09-26