Reported by 10 outlets
Mini Shai-Hulud worm re-infects GitHub repositories via hijacked Actions
Why this score
- Breadth
- 2.00 / 2.0 · 10 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.28 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
The Mini Shai-Hulud supply-chain worm continues to reinfect GitHub repositories through hijacked Actions. Two previously compromised actions, actions-cool/issues-helper and actions-cool/maintain-one-comment, were re-enabled by their maintainer on September 16 and remained active through September 25 without cleaning malicious release tags. According to Socket researchers, the tags still point to the same commit containing an obfuscated payload inside index.js, meaning any workflow referencing these actions by version tag resumes downloading and executing malware. The original May campaign affected 323 npm packages and 639 versions, stealing developer tokens, credentials, and CI/CD secrets.
The reactivation highlights persistent supply-chain risk when compromised repositories are restored without auditing release tags or removing malicious artifacts. Organizations using GitHub Actions should audit pinned actions for unexpected commit hashes, avoid floating version tags for unmaintained actions, and rotate CI secrets after any dependency update involving these repositories. Monitor Socket and GitHub Security advisories for additional indicators.
Timeline
-
original reporting
(safedep.io) Persistent Mini Shai-Hulud Worm Continues to Infect GitHub Repositories via Hijacked GitHub Actions In brief - This article det
safedep.io · 19d ago · September 24th, 2026
(safedep.io) Persistent Mini Shai-Hulud Worm Continues to Infect GitHub Repositories via Hijacked GitHub Actions In brief - This article det
via Mastodon https://safedep.io/mini-shai-hulud-reinfection-github-repositories
-
update from socket.dev
Mini Shai-Hulud Hits @antv Ecosystem, 639 Compromised npm Package Versions
socket.dev · 148d ago · May 19th, 2026
Socket's original disclosure of the May 2026 Mini Shai-Hulud wave that this September GitHub Actions re-infection descends from. 639 compromised npm versions across 323 unique packages were tied to the atool maintainer account, concentrated in @antv packages and echarts-for-react with roughly 1.1 million weekly downloads. The payload exfiltrates RSA+AES encrypted data to t.m-kosche[.]com disguised as OpenTelemetry traces and also commits stolen secrets to public GitHub repositories with Dune-themed names and the reversed marker "Shai-Hulud: Here We Go Again". Across the full campaign Socket tracked 1,055 compromised versions across 502 packages spanning npm, PyPI, and Composer, and counted roughly 1.9k attacker exfiltration repositories.
-
update from safedep.io
Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised
safedep.io · 147d ago · May 19th, 2026
SafeDep's May 19, 2026 analysis of the same campaign: 637 malicious versions were published across 317 packages in a 22-minute automated burst, hitting packages with 15M+ combined monthly downloads including size-sensor, echarts-for-react, and timeago.js. The 498KB obfuscated Bun payload harvests CI and developer credentials, injects Claude Code SessionStart hooks and VS Code folderOpen tasks, installs the kitty-monitor dead-drop C2 backdoor that polls GitHub commit search for RSA-PSS signed commands containing the keyword firedalazer, and exfiltrates through the GitHub Git Data API and t.m-kosche[.]com. This is the payload analysis the September re-infection reporting points back to, including the wiper, the gh-token-monitor polling daemon, and the Dune-named exfiltration repository pattern.
-
mentioned by socket.dev
(socket.dev) Reactivation of Compromised GitHub Actions Exposes Thousands of Repositories to Mini Shai-Hulud Malware In brief - This article
socket.dev · 19d ago · September 24th, 2026
-
update from deafnews.it
Two compromised GitHub Actions dormant since May reactivated this week, executing malicious payloads in CI/CD pipelines. Containment failed.
deafnews.it · 18d ago · September 25th, 2026
Two compromised GitHub Actions dormant since May reactivated this week, executing malicious payloads in CI/CD pipelines. Containment failed. via Mastodon https://deafnews.it/en/article/github-actions-mini-shai-hulud-reactivated-containment-turns-into-attack
-
update from threatnoir.com
⚠️ CRITICAL: Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud Two GitHub Actions (issues-helper and maintain-on
threatnoir.com · 17d ago · September 26th, 2026
⚠️ CRITICAL: Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud Two GitHub Actions (issues-helper and maintain-on
via Mastodon https://threatnoir.com/focus
-
mentioned by thehackernews.com
Compromised GitHub Actions from the May 2026 Mini Shai-Hulud campaign re-enabled Sept 16 and resumed malicious execution
thehackernews.com · 17d ago · September 26th, 2026
-
update from bleepingcomputer.com
GitHub Actions re-enabled with Mini Shai-Hulud payload still active
bleepingcomputer.com · 17d ago · September 26th, 2026
Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. After being compromised on May 18, the GitHub security team removed actions-cool/issues-helper and actions-cool/maintain-one-comment, preventing any downstream workflow from downloading malware. According to researchers at application security company Socket, starting September 16 and up to September 25, the two actions became active again with the same release tags, causing workflows referencing their actions to download and execute the old payload. The Mini Shai-Hulud supply-chain attack in May affected 323 packages and 639 package versions on the Node Package Manager (npm) index, infecting them with malware that targets developers’ tokens, credentials, and CI/CD secrets. Their release tags were not cleaned up first," Socket explained . "They still point to the malicious content introduced on May 18, so any workflow that references either action by a version tag resumed downloading and executing the payload on its next run.” It is unclear exactly why these repositories were re-enabled without pr
-
mentioned by www.bleepingcomputer.com
# GitHub Actions re-enabled with Mini # ShaiHulud payload still active https://www. bleepingcomputer.com/news/secu rity/github-actions-re-en
www.bleepingcomputer.com · 17d ago · September 26th, 2026
-
mentioned by www.bleepingcomputer.com
GitHub Actions re-enabled with Mini Shai-Hulud payload still active Source: BleepingComputer Read: https://www. bleepingcomputer.com/news/se
www.bleepingcomputer.com · 17d ago · September 27th, 2026
-
mentioned by www.rescana.com
https://www. rescana.com/post/active-exploi tation-alert-compromised-github-actions-reactivated-resuming-mini-shai-hulud-malware-supply-chai
www.rescana.com · 15d ago · September 28th, 2026
-
update from securityexpress.info
Discover how the reopening of compromised GitHub Actions repositories reignited the Mini Shai-Hulud supply chain attack, exposing CI/CD secr
securityexpress.info · 15d ago · September 28th, 2026
Discover how the reopening of compromised GitHub Actions repositories reignited the Mini Shai-Hulud supply chain attack, exposing CI/CD secr
via Mastodon https://securityexpress.info/github-reopens-repos-mini-shai-hulud/?utm_source=mastodon&utm_medium=jetpack_social
-
update from linuxmint.hu
Compromised actions-cool GitHub Actions workflows are reachable again and Mini Shai-Hulud malware re-ran automatically
linuxmint.hu · 15d ago · September 28th, 2026
The two compromised actions-cool GitHub Actions workflows have become reachable again, and the Mini Shai-Hulud malware from the May compromise automatically started running once more. The article examines the scale of the re-infection risk. via Mastodon https://linuxmint.hu/hir/2026/09/visszatert-a-feltort-github-actions-es-ujra-futtatni-kezdte-a-mini-shai-hulud-kartevot
-
mentioned by socket.dev
:github: GitHub Actions re-enabled with Mini Shai-Hulud Payload still active. Two third-party GitHub Actions previously compromised in a Min
socket.dev · 12d ago · October 1st, 2026