Two GitHub Actions previously compromised during the Mini Shai-Hulud campaign became accessible again in September while release tags still pointed to malicious content, according to research from Socket. GitHub has since disabled the affected repositories again.
Availability reactivated an existing dependency risk
The affected actions, actions-cool/issues-helper and actions-cool/maintain-one-comment, had been disabled after malicious code was introduced in May. Socket reported that the repositories returned on September 16 without the compromised release tags being cleaned. Workflows referencing those mutable tags could therefore download and execute the old payload even though no new malicious version was published.
The payload was associated with credential theft from CI/CD environments. The event illustrates why containment cannot rely only on making a repository unavailable: tags, releases and downstream references must also be reviewed before access is restored.
Consumers need immutable references and recovery checks
Development teams should locate references to the affected actions, rotate exposed secrets and inspect workflow history after the repositories reappeared. Pinning third-party actions to reviewed commit hashes reduces dependence on mutable upstream tags, although the selected commit still needs security review.
The incident extends the risk described in SectechMedia’s Cyber-Physical Security coverage. Organizations should inventory external workflow components, monitor ownership and availability changes, and treat repository restoration as a security-sensitive event rather than a purely operational one.
Leave a Reply