Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware Ravie LakshmananSep 25, 2026Malware / Supply Chain Attack Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below – actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this repository has been disabled by GitHub Staff due to a violation of GitHub's terms of service. If you are the owner of the repository, you may reach out to GitHub Support for more information." "On September 16, 2026, both repositories became accessible again," Socket researcher Karlo Zanki said.…