Disabled GitHub Actions Came Back Online Still Stealing CI Secrets With Mini Shai-Hulud

Two GitHub Actions that were shut down in May for stealing secrets quietly came back to life in September. The malware was still inside them.

The actions, issues-helper and maintain-one-comment from the actions-cool organization, were compromised on May 18 in the Mini Shai-Hulud supply-chain campaign. On September 16 they became reachable again, and any pipeline that still referenced them by version tag started running the payload once more.

Disabled, not cleaned

In May, attackers pointed the projects' release tags at impostor commits. Those commits harvested CI/CD credentials and sent them to t.m-kosche.com, infrastructure that overlaps with the compromised @antv npm packages.

GitHub disabled both repositories on May 19, which stopped downloads. But nobody removed the malicious commits or reset the tags. For roughly four months the trap sat dormant.

Then, on September 16, both repositories became accessible again, with the window starting around 09:09 UTC. A workflow calling something like [email protected] resolved straight to the May 18 malware and executed it inside the build, with whatever secrets that build could see.

Nine days of exposure

Socket researchers spotted the re-exposure, and GitHub disabled both repositories again on September 25. Thousands of downstream repositories used the actions with mutable tags and were potentially exposed in between.

Potentially is the key word. Referencing the action does not prove a repo was breached; it depends on whether a workflow actually ran in that window. GitHub itself was not newly compromised, and this is the same Mini Shai-Hulud malware, not a new family.

Teams that pinned actions to the full commit SHA of a clean pre-May 18 version were never hit. Tags can be moved. SHAs cannot. It is the same lesson package ecosystems keep relearning, most recently with the poisoned OpenAPI codegen package on npm.

For everyone else, the response is to remove or SHA-pin both actions, review workflow runs since September 16, and rotate any secret those runs could touch.