Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

Ravie LakshmananSep 25, 2026Malware / Supply Chain Attack

GitHub Actions have once again come under scrutiny as two popular workflows were disabled after being compromised during the May 2026 Mini Shai-Hulud campaign. The repositories associated with these actions have been inaccessible since last week, only to resurface and be disabled once more.

The affected GitHub Actions, known for automating issue and comment management, posed a significant security risk by running malicious code to extract sensitive credentials from CI/CD pipelines. The malicious activities were traced back to the Mini Shai-Hulud activity cluster, indicating a persistent threat that resurfaced when the repositories became accessible again.

Despite being re-enabled on September 16, 2026, the repositories remained tainted with the malicious code, raising concerns about supply chain security risks. Developers are advised to review their workflows, remove affected actions, and update to clean versions to mitigate the threat.

This incident underscores the importance of maintaining clean workflows and vigilance against supply chain attacks. By pinning actions to specific commit SHAs, developers can reduce dependency on upstream repositories and prevent similar incidents in the future.