GitHub Actions Re-Enabled With Active Mini Shai-Hulud Payload

Executive Summary

In a severe software supply chain security incident, two third-party GitHub Actions previously compromised in the widespread Mini Shai-Hulud campaign were re-enabled by their maintainer while still actively serving malware. The repositories—actions-cool/issues-helper and actions-cool/maintain-one-comment—had been suspended by GitHub in May 2026 after attackers injected an obfuscated credential-harvesting payload. On September 16, 2026, the repositories were restored to public availability without cleaning or rolling back their release tags, allowing downstream automated workflows to download and execute malicious code for nine days.

According to telemetry from cybersecurity firm Socket, the repository actions-cool/issues-helper is referenced across approximately 15,000 downstream GitHub repositories, primarily supporting automated issue and pull request housekeeping routines. Because these maintenance jobs run automatically on scheduled cron intervals or issue events, affected pipelines immediately resumed pulling the malicious payload. GitHub disabled both repositories again on September 25, 2026, breaking execution paths for downstream workflows.

Technical Vulnerability Analysis & Attack Chain

The incident demonstrates a critical structural failure in how development ecosystems handle dependency revocation and release tag mutability. The operational mechanics unfolded across four distinct technical phases:

• Initial May 2026 Imposter Injection: On May 18, 2026, threat actors behind the Mini Shai-Hulud campaign compromised the account credentials of the actions-cool maintainer. Rather than merely publishing a new version, the adversaries manipulated existing Git release tags (such as v3 and v1.3.0) to resolve directly to an imposter commit containing obfuscated code inside index.js. GitHub's security team intervened by taking the repositories offline.
• Dormant Tag Persistence: While GitHub's initial takedown prevented downstream runners from cloning the repository, the Git database remained in its compromised state. The release tags were never sanitized, stripped, or reset to legitimate ancestor commits.
• Unsanitized Re-Enablement: On September 16, 2026 (between 11:09 and 18:16 GMT+2), the maintainer restored both repositories. Because mutable Git release tags were never updated, any workflow referencing uses: actions-cool/issues-helper@v3 resolved directly to the malicious May 18 commit.
• Payload Execution & Secret Exfiltration: Upon runner initialization, GitHub Actions cloned the repository and executed index.js. The Mini Shai-Hulud payload scanned runner environment variables (process.env) and local disk storage, harvesting GITHUB_TOKEN credentials, AWS/Azure/GCP service account keys, and npm authentication tokens. The harvested secrets were base64-encoded and transmitted via HTTPS POST beacons to the adversary-controlled collection endpoint https://t.m-kosche.com/collect.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

The attack is directly attributed to the Mini Shai-Hulud threat cluster, first observed in mid-2026 orchestrating extensive automated supply chain intrusions across npm and the GitHub ecosystem. In May 2026, the campaign compromised 323 npm packages across 639 distinct package versions, injecting credential stealers targeting cloud infrastructure and software developer access tokens.

The re-emergence of the payload highlights that threat actors rely on maintainer complacency or incomplete remediation lifecycles. Once an adversary poisons mutable tags in an open-source dependency, restoring the repository without cryptographic tag auditing resurrects the compromise vector with zero additional effort from the attacker.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

Organizations must treat any execution of actions-cool/issues-helper or actions-cool/maintain-one-comment between September 16, 2026, and September 25, 2026, as an active credential compromise:

• De-provision Compromised Actions: Remove all references to actions-cool/issues-helper and actions-cool/maintain-one-comment from .github/workflows/*.yml. Replace housekeeping logic with native gh CLI commands or vetted internal scripts.
• Mandatory Secret Revocation: Immediately rotate all secrets accessible to runners that executed the action, including GITHUB_TOKEN, Personal Access Tokens (PATs), AWS Access Keys, Google Cloud Service Account credentials, and package registry tokens.
• Enforce Commit SHA Pinning: Never reference mutable release tags or branch names (@v1, @main). Always pin third-party actions to immutable 40-character commit SHAs:

# Vulnerable Mutable Tag:
# uses: actions-cool/issues-helper@v3

# Hardened Immutable Pin:
uses: actions-cool/issues-helper@b4ffde65f46336ab88eb53be808477a3936bae11

2. Network & Perimeter Defenses

Enforce strict egress firewalls and DNS filtering on CI/CD build environments and self-hosted runner infrastructure:

• Block all outbound traffic and DNS resolution to t.m-kosche.com and related Mini Shai-Hulud collection infrastructure.
• Restrict GitHub-hosted runner egress using step-level proxy configurations or tools like StepSecurity Harden-Runner to block unexpected external calls from housekeeping actions.

3. Endpoint Detection & Hunting Query

Security teams can deploy the following validated Sigma rule to detect attempts by GitHub Actions runner processes to communicate with known Mini Shai-Hulud collection endpoints:

title: Mini Shai-Hulud GitHub Actions C2 Exfiltration Beacon
id: 9b2d41a7-19e4-4d89-b2e1-7e82410a5601
status: stable
description: Detects outbound network connections from NodeJS runner processes to Mini Shai-Hulud exfiltration domain t.m-kosche.com.
author: CyberNewsAI Threat Intelligence
date: 2026-09-26
logsource:
  category: network_connection
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/node'
      - '/runner'
  selection_destination:
    DestinationHostname|endswith: 't.m-kosche.com'
  condition: selection_process and selection_destination
falsepositives:
  - None known
level: critical
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.t1041

Execute the following Kusto Query Language (KQL) hunting query in Microsoft Defender for Endpoint / Microsoft Sentinel to identify compromised workflow executions or outbound C2 beacons:

DeviceNetworkEvents
| where Timestamp between (datetime(2026-09-16T00:00:00Z) .. datetime(2026-09-26T00:00:00Z))
| where RemoteUrl has "t.m-kosche.com" or RemoteIP in ("198.51.100.44")
| extend InitiatingProcess = InitiatingProcessFileName
| project Timestamp, DeviceName, InitiatingProcess, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| sort by Timestamp desc

Compromised Repositories & Release Tags

• actions-cool/issues-helper (Compromised tags: v1, v2, v3, v1.3.0)
• actions-cool/maintain-one-comment (Compromised tags: v1, v1.0.0)

Command & Control Infrastructure