Old Malicious GitHub Actions Briefly Reactivated, Reviving Mini Shai-Hulud Threat

Two GitHub Actions that were compromised back in May 2026 as part of the Mini Shai-Hulud supply chain attack briefly came back online on September 16, 2026. According to researchers at Socket, the repositories' release tags were never cleaned up after the original compromise, meaning they still pointed to the malicious code introduced in May. Any workflow referencing these actions by version tag would have automatically downloaded and run the malicious payload again on its next execution.

The original attack harvested sensitive credentials from CI/CD pipelines and sent them to an attacker-controlled server. Investigators linked the activity to the wider Mini Shai-Hulud campaign due to overlapping infrastructure with malicious npm packages. Both affected GitHub Actions were commonly used for routine tasks such as closing inactive issues or updating bot comments, meaning many organisations may have unknowingly relied on them.

GitHub has since disabled the repositories again for violating its terms of service, but it remains unclear why they were briefly reachable. The incident highlights a serious supply chain risk: because the malicious code was never removed, attackers did not need new exploits or infrastructure to potentially compromise systems again, simply the repositories becoming available was enough.