Compromised GitHub Actions re-enabled, posing supply chain risks

Two GitHub Actions from the actions-cool organization have been disabled for a second time after their repositories were compromised and subsequently re-enabled, months after being affected by the May 2026 Mini Shai-Hulud campaign. The repositories, actions-cool/issues-helper and actions-cool/maintain-one-comment, were found to still contain malicious code after being made accessible again, as reported by The Hacker News.

The compromised GitHub Actions were originally disabled on May 18, 2026, after being found to execute malicious code that harvested sensitive credentials from CI/CD pipelines. This activity was linked to the Mini Shai-Hulud campaign due to overlaps with malicious npm packages. The repositories were re-enabled on September 16, 2026, without the malicious code being cleaned up. This allowed any workflow referencing the actions by version tag to resume executing the payload upon their next run, creating significant software supply chain security risks. The actions automate issue and comment management, and workflows calling them typically run on a daily schedule or upon issue/pull request creation, meaning many affected repositories likely ran the payload within a day of re-enablement.

The incident highlights the risks associated with mutable tags, as the malicious code was reactivated without any changes to the workflow files. Developers are advised to pin actions to specific commit SHAs predating the compromise, rotate secrets, and audit their repositories.

Source: The Hacker News