Two GitHub Actions re-enabled with Mini Shai-Hulud payload still

🚨 ACTIVE EXPLOITATION

• Two GitHub Actions re-enabled with Mini Shai-Hulud payload still active
  Two GitHub Actions compromised in the Mini Shai-Hulud campaign were re-enabled by their maintainer and served malware to workflows for over a week.
  • Affects users of the third-party GitHub Actions actions-cool/issues-helper and actions-cool/maintain-one-comment; GitHub's dependency graph lists about 15,000 repositories depending on issues-helper.
  • The actions' release tags still pointed to the malicious May 18 commit containing an obfuscated payload in index.js, so workflows referencing them by version tag downloaded and executed the malware.
  • The repositories were re-enabled on September 16, 2026 without the malicious tags being cleaned, and were disabled again on September 25 after Socket flagged them.
  • The Mini Shai-Hulud supply-chain attack steals developers' tokens, credentials, and CI/CD secrets; the May campaign infected 323 npm packages across 639 versions.
  • The exposure window began September 16 between 11:09 and 18:16 GMT+2.
  Sources 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

📋 ADVISORIES

• 📄 Source for Joomla YouTube Gallery extension patched unauthenticated SQL injection (CVE-2026-94130) — cve.threatint.com