Two Hijacked GitHub Actions Came Back Online With Mini Shai-Hulud Malware Still Inside

Two GitHub Actions that were hijacked in May’s Mini Shai-Hulud campaign spent more than a week back online in September, still serving the same credential-stealing code. GitHub disabled actions-cool/issues-helper and actions-cool/maintain-one-comment for a second time on Friday, The Hacker News reported.

Nobody had to break in again. According to Socket’s write-up, the attacker moved the release tags of both actions to malicious commits on May 18, and GitHub’s security team disabled the repositories the next day. Disabling them stopped the attack, but the tags were never cleaned up. When both repositories became reachable again on Sept. 16, any workflow that referenced either action by a version tag, such as @v2.2.1, started downloading and running the payload on its next run.

“No new code was published and no configuration was changed,” Socket researcher Karlo Zanki wrote. Socket said it could not determine why the repositories were re-enabled.

The reach is wide. GitHub’s dependency graph lists about 15,000 repositories that depend on issues-helper alone, though Socket said it has not worked out how many of them pin the action by tag rather than by commit SHA. Both tools handle routine issue and comment housekeeping and usually run on a daily schedule or whenever someone opens an issue or pull request, so Socket expects most affected repositories ran the payload within a day.

The malicious version installs the Bun runtime and runs an obfuscated script before handing off to the real action, so the workflow still appears to succeed. Socket spotted the change in run histories: jobs that had been failing in two seconds with “Repository access blocked” suddenly took nine to 11 minutes.

SafeDep found the payload spreading further. Between Sept. 20 and 24, it said, six more repositories were infected through issues-helper, including ant-design/pro-components, jd-opensource/micro-app and MaaXYZ/MaaFramework. “The payload steals the CI secrets. Then it commits Claude Code and VS Code hooks into the repository,” SafeDep said. “A developer who pulls the change and opens the project runs the malware on their own machine.”

Workflows pinned to the full commit SHA of a release from before May 18 were not affected. Socket advises teams to search .github/workflows/ for both actions, remove them or pin them to a known-clean SHA, rotate every secret those workflows could reach after Sept. 16, and check repository history for commits they can’t account for. GitHub has added other npm and Actions defenses this year, but Zanki’s point was narrower: “SHA pinning removes that dependency on the upstream repository’s state.”