actions-cool Actions Re-Enabled With Mini Shai-Hulud Payload

What to do

1. Search .github/workflows/ for actions-cool/issues-helper@ and actions-cool/maintain-one-comment@ and remove or replace them.
2. Rotate every secret and token reachable by a workflow that ran either action by tag on or after September 16, 2026.
3. Check default branches for new .claude/settings.json, .claude/setup.mjs, .claude/index.js or .vscode/tasks.json files and revert them.
4. Before revoking tokens on a developer machine that opened an infected repo, remove gh-token-monitor and kitty-monitor persistence, because the payload ships a wiper.
5. Pin every third-party action to a full-length commit SHA you have reviewed.

How to check if you are affected or compromised

• grep -rnE 'actions-cool/(issues-helper|maintain-one-comment)@' .github/workflows/
• In Actions run history, look for runs that switch from seconds-long 'Repository access blocked' failures to multi-minute successes on September 16, 2026, or logs showing oven-sh/setup-bun and bun run $GITHUB_ACTION_PATH/index.js inside the action.
• git log --since=2026-09-16 -- .claude .vscode/tasks.json, and look for commits by github-actions[bot] you did not expect.
• On developer machines, look for ~/.local/bin/gh-token-monitor.sh, ~/.local/share/kitty/cat.py and traffic to t.m-kosche.com.

What happened#

Two GitHub Actions poisoned during the May 2026 Mini Shai-Hulud campaign came back online in September with their malicious tags still in place. On May 18, 2026, the attacker moved every release tag of actions-cool/issues-helper (53 tags) and actions-cool/maintain-one-comment (15 tags) to new unsigned commits titled Build action for <tag>. GitHub disabled both repositories on May 19 but did not rewrite or remove the tags. On September 16, 2026, between 09:09 and 16:16 UTC, both repositories became accessible again. The reason has not been disclosed.

Socket found the reactivation in workflow run histories. Jobs that had been failing in two seconds with "Repository access blocked" suddenly ran for nine to eleven minutes and downloaded actions-cool/issues-helper@v2.2.1. Its September 24 report notes that issues-helper alone has about 15,000 dependent repositories in GitHub's dependency graph. Socket has not determined how many of them reference the action by a mutable tag. The same day, SafeDep documented six newly infected repositories between September 20 and 24, including ant-design/pro-components, jd-opensource/micro-app and MaaXYZ/MaaFramework. It reports the payload is byte-identical to the May build. Socket's September 25 update says both actions were disabled again. The repository page now says access "has been disabled by GitHub Staff due to a violation of GitHub's terms of service."

Who is affected#

Any workflow that calls either action by tag (@v2.1.1, @v2.2.0, @v2.2.1, @v3 and so on) and ran while the repositories were live. These are issue-housekeeping bots that run daily or on issue events, so most affected workflows probably fired within a day. The malicious action.yml installs Bun, runs the obfuscated index.js, then calls the real action so the step still passes. On the runner, SafeDep found that it reads the job's ghs_ token from runner memory. It then commits .claude/settings.json (a SessionStart hook), .vscode/tasks.json, .claude/setup.mjs and .claude/index.js into the repository through the GraphQL API, so the commits appear verified as github-actions[bot]. A developer who later pulls and opens that repository in Claude Code or VS Code runs the worm locally. On developer machines it installs the kitty-monitor backdoor and can install the token monitor and its wiper. The May payload itself is covered in our earlier Mini Shai-Hulud brief.

Do you really need to act?#

Only if you use these actions, and that takes one search to confirm. If you referenced them by tag and a run succeeded on or after September 16, treat it as a live compromise of that repository's secrets and default branch. Pinning to a commit SHA helps only if that commit is clean: every tag now resolves to attacker commits such as a0c53dd42fc8 (v2.2.1), so pin only a SHA you have verified predates May 18. The second disablement stopped new runs, but hook files already committed stay in place. SafeDep found all six infected default branches still carried them. The general lesson, which GitHub's own guidance repeats, is that tags are mutable and a disabled repository can come back.

What to do now#

1. Find references: grep -rnE 'actions-cool/(issues-helper|maintain-one-comment)@' .github/workflows/, or use GitHub code search across your org. Remove the actions or replace them.
2. Rotate every secret the affected workflows could read, plus deploy keys and package-registry tokens. Review the job's GITHUB_TOKEN permissions and set permissions: to the minimum.
3. Revert injected files: git log --since=2026-09-16 --stat -- .claude .vscode/tasks.json, then remove the hooks and force fresh clones for contributors.
4. On developer machines that opened an infected checkout, remove gh-token-monitor and kitty-monitor persistence before revoking GitHub tokens, then rotate local credentials.
5. Pin all third-party actions to full-length commit SHAs and review updates before bumping them.

How to tell if you were hit#

In the Actions run history, look for the pattern Socket describes: quick setup failures through September 15, then a long successful run on September 16. Job logs that show oven-sh/setup-bun or bun run $GITHUB_ACTION_PATH/index.js inside the action step confirm execution. On the repository side, look for unexpected github-actions[bot] commits adding .claude/ or .vscode/tasks.json. A commit message copied from its parent is another sign: in pro-components, both read 3.1.14-7. SafeDep lists the payload blob 2931c1be43b0, the exfiltration host t.m-kosche.com and commit markers firedalazer and thebeautifulmarchoftime.

Timeline#

• May 18, 2026 — All tags of both actions are moved to malicious commits (19:10 to 19:31 UTC).
• May 19, 2026 — GitHub disables both repositories, leaving the tags unchanged.
• Sep 16, 2026 — Both repositories become accessible again, and tag-referencing workflows resume running the payload.
• Sep 20–24, 2026 — SafeDep records six newly infected repositories.
• Sep 24, 2026 — Socket and SafeDep publish their findings.
• Sep 25, 2026 — Both actions are disabled again. BleepingComputer and The Hacker News report the reactivation.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Socket — Re-enabled GitHub Actions expose thousands of repositories to Mini Shai-Hulud socket.dev
2. SafeDep — Mini Shai-Hulud is still infecting GitHub repositories safedep.io
3. GitHub — actions-cool/issues-helper (repository disabled by GitHub Staff) github.com
4. GitHub — actions-cool/maintain-one-comment (repository disabled by GitHub Staff) github.com
5. GitHub Docs — Secure use reference: pin actions to a full-length commit SHA docs.github.com

Coverage and analysis

1. The Hacker News — Compromised GitHub Actions came back online and resumed executing Mini Shai-Hulud malware thehackernews.com
2. BleepingComputer — GitHub Actions re-enabled with Mini Shai-Hulud payload still active bleepingcomputer.com