"On September 16, 2026, both repositories became accessible again. Their release tags were not cleaned up first," Socket explained.
What Socket found in the re-enabled actions-cool repositories
Researchers at application security company Socket reported that two third-party GitHub Actions — actions-cool/issues-helper and actions-cool/maintain-one-comment — were re-enabled by their maintainer starting September 16 and remained accessible through at least September 25. The re-enabled repositories used the same release tags that had pointed to malicious code when the actions were first compromised on May 18. According to Socket, the release tags resolved to a commit that contained an obfuscated payload inside an 'index.js' file, and workflows that referenced the actions by those version tags resumed downloading and executing the old payload on their next run.
Technical detail: the payload and what it targeted
Socket's analysis identified the obfuscated payload inside the 'index.js' file of the re-enabled releases. The payload is the same code introduced during the Mini Shai-Hulud supply-chain attack in May, which infected packages with malware designed to target developers' tokens, credentials, and CI/CD secrets. The original Mini Shai-Hulud campaign affected 323 packages and 639 package versions on the Node Package Manager (npm) index, according to the source material Socket cited.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageScale of potential exposure and what is known
Socket reported that GitHub’s dependency graph lists about 15,000 repositories depending on 'issues-helper.' The researchers cautioned that this figure does not mean all those repositories were compromised. Socket has not established how many dependents reference either action by a mutable tag rather than by a pinned commit. The affected actions are used for issue-housekeeping tasks and, Socket notes, are actions that run almost daily—meaning workflows that reference them are likely to have run frequently while the tags remained pointed at the malicious commit.
Timeline: compromise, removal, re-enable, and re-disable
The initial compromise of the two actions occurred on May 18, at which point GitHub's security team removed actions-cool/issues-helper and actions-cool/maintain-one-comment to prevent downstream workflows from downloading malware. Socket's findings show the repositories became accessible again on September 16. Socket specifies the exposure window began on September 16 between 11:09 and 18:16 GMT+2. On September 25, Socket found that both actions were disabled again on GitHub; at that point, workflows that reference the actions failed instead of running the malicious payload.
Socket's recommendations for developers and administrators
Socket offered a concise set of mitigations for teams that may have been exposed:
- Find references to actions-cool/issues-helper and actions-cool/maintain-one-comment in workflows and remove them or pin to a verified clean commit.
- Review workflow runs since September 16 for signs of the malicious activity.
- Rotate secrets accessible to any workflows that ran an affected tag.
Socket also highlighted uncertainty about exactly why the repositories were re-enabled without the release tags being cleaned up first, leaving a window in which workflows using version tags automatically retrieved the previously malicious content.
The reappearance of the Mini Shai-Hulud payload inside widely referenced GitHub Actions underscores how mutable tags and third-party workflow components can reintroduce previously removed threats. For maintainers and teams using community actions, the immediate, actionable steps Socket set out — removing or pinning references, auditing runs, and rotating secrets — are the concrete measures available now to limit exposure.
Source: BleepingComputer — GitHub Actions re-enabled with Mini Shai-Hulud payload still active
