Two Compromised GitHub Actions Re-Enabled With Malicious Payloads for Over a Week

Summary

Two GitHub Actions compromised in the Mini Shai-Hulud campaign were re-enabled from September 16 to 25, 2026, with malicious tags still active. Socket advised removing or pinning them, reviewing workflow runs, and rotating exposed secrets.

Key points

• The actions-cool/issues-helper and actions-cool/maintain-one-comment repositories were re-enabled with release tags still pointing to malicious code introduced on May 18.
• From September 16 through September 25, workflows referencing either action by a version tag could download and run the payload; the number of affected workflows is unknown.
• The payload was in an obfuscated index.js file. The malware targeted developer tokens, credentials, and CI/CD secrets.
• Socket said GitHub’s dependency graph listed about 15,000 repositories depending on issues-helper, but that does not mean they were compromised.
• GitHub disabled both actions again on September 25, causing workflows referencing them to fail rather than run the payload.
• Socket advised finding references to both actions, removing them or pinning a verified clean commit, reviewing workflow runs since September 16, and rotating secrets accessible to affected runs.

Malware

Vendors

Products

Related Articles

• How Developer Dependency Culture Became a Major Software Supply-Chain Attack Surfaceblog.eclecticiq.comChainDrop · GitHub Actions · npm
• ChainDrop npm Worm Steals Developer Credentials and Spreads Malicious Packageszscaler.comChainDrop · GitHub Actions · npm
• Miasma/Mini Shai-Hulud Campaign Hits LeoPlatform npm Packages, GitHub Actions and a Go Projectsocket.devChainDrop · GitHub Actions · npm
• Miasma PyPI Campaign Uses Malicious Wheels to Target Developer Credentialssocket.devChainDrop · GitHub Actions · npm
• Miasma Supply-Chain Attack Compromises Red Hat npm Packageswiz.ioChainDrop · GitHub Actions · npm