Compromised GitHub Actions Repeatedly Resumed Serving Mini Shai-Hulud Malware

What happened

Two GitHub Actions — actions-cool/issues-helper and actions-cool/maintain-one-comment — were compromised during the May 2026 Mini Shai-Hulud supply-chain campaign. According to reporting from The Hacker News, the affected repositories became accessible again last week and resumed executing the malicious code before being disabled a second time. Visiting either repository currently shows an access-restricted message.

Why it matters

This is a supply-chain risk for any workflow that pinned or referenced these actions. Because GitHub Actions are frequently referenced by tag or branch rather than an immutable commit SHA, a compromised action can silently resume malicious behavior in downstream CI/CD pipelines whenever the repository becomes reachable again — even months after the initial compromise and takedown. Organizations that consumed either action, directly or transitively, may have unknowingly re-executed the malware during the window it was back online.

Who is affected

Any repository or organization with workflows referencing actions-cool/issues-helper or actions-cool/maintain-one-comment — including indirect dependents that pull these actions in via composite or reusable workflows.

What defenders should do now

• Audit CI/CD workflows (.github/workflows/*.yml) for any reference to actions-cool/issues-helper or actions-cool/maintain-one-comment, including indirect references via composite/reusable workflows.
• Pin third-party GitHub Actions to a specific commit SHA rather than a tag or branch, so a repository re-compromise can't silently change what code runs.
• Review GitHub Actions run logs and audit logs for the affected repositories' involvement in any workflow runs during the period they were reachable, and check for unexpected outbound network connections or credential/secret exfiltration from CI runners around that time.
• Hunt for indicators associated with the broader Mini Shai-Hulud campaign in build logs and CI runner telemetry, and rotate any secrets exposed to affected workflows out of an abundance of caution.
• Consider organization-wide policies restricting which third-party actions can be used, or requiring SHA pinning, to reduce exposure to this class of repeat-compromise risk.

Developing story

This is a developing situation without a specific CVE, and details on scope and current status may change as more information emerges. For the latest reporting, see the original source at The Hacker News.