---
title: "actions-cool Actions Re-Enabled With Mini Shai-Hulud Payload"
url: https://erroneo.us/security/briefs/actions-cool-mini-shai-hulud-reactivation/
description: "issues-helper and maintain-one-comment returned Sep 16, 2026 with May's malicious tags intact and ran the worm in CI again. Check tag refs, rotate secrets."
type: security-brief
section: "Security Digest"
date_published: 2026-09-24
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: []
severity: "high"
exploited: "in-the-wild"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# actions-cool Actions Re-Enabled With Mini Shai-Hulud Payload

**Verdict: Check exposure.** If any workflow referenced either actions-cool action by tag and ran between September 16 and 25, 2026, assume its secrets and repository were compromised; everyone else can confirm with one grep.

- **Who must act:** Owners of repositories whose workflows call actions-cool/issues-helper or actions-cool/maintain-one-comment by a version tag such as @v2.2.1 or @v3, and developers who pulled from those repositories after September 16, 2026.
- **Who can relax:** Repositories that never used these two actions, or pinned them to a full commit SHA verified to predate May 18, 2026; since about September 25, the disabled actions make workflows fail at setup instead of running the payload.
- **Affected:** actions-cool/issues-helper: all 53 tags moved to malicious commits on May 18, 2026 (e.g. v2.1.1, v2.2.0, v2.2.1, v3); actions-cool/maintain-one-comment: all 15 tags moved on May 18, 2026; Workflows that ran either action by tag from Sep 16, 2026 until the second disablement (~Sep 25, 2026)
- **Fixed:** No clean release; both repositories disabled again by GitHub Staff (reported Sep 25, 2026); Remove the actions or pin a full commit SHA verified to predate May 18, 2026
- **CVEs:** none
- **CISA KEV:** no · **Exploitation:** Exploited in the wild

## What to do

1. Search .github/workflows/ for actions-cool/issues-helper@ and actions-cool/maintain-one-comment@ and remove or replace them.
2. Rotate every secret and token reachable by a workflow that ran either action by tag on or after September 16, 2026.
3. Check default branches for new .claude/settings.json, .claude/setup.mjs, .claude/index.js or .vscode/tasks.json files and revert them.
4. Before revoking tokens on a developer machine that opened an infected repo, remove gh-token-monitor and kitty-monitor persistence, because the payload ships a wiper.
5. Pin every third-party action to a full-length commit SHA you have reviewed.

### How to check if you are affected

- grep -rnE 'actions-cool/(issues-helper|maintain-one-comment)@' .github/workflows/
- In Actions run history, look for runs that switch from seconds-long 'Repository access blocked' failures to multi-minute successes on September 16, 2026, or logs showing oven-sh/setup-bun and bun run $GITHUB_ACTION_PATH/index.js inside the action.
- git log --since=2026-09-16 -- .claude .vscode/tasks.json, and look for commits by github-actions[bot] you did not expect.
- On developer machines, look for ~/.local/bin/gh-token-monitor.sh, ~/.local/share/kitty/cat.py and traffic to t.m-kosche.com.

## What happened

Two GitHub Actions poisoned during the May 2026 Mini Shai-Hulud campaign came back online in September with their malicious tags still in place. On May 18, 2026, the attacker moved every release tag of `actions-cool/issues-helper` (53 tags) and `actions-cool/maintain-one-comment` (15 tags) to new unsigned commits titled `Build action for <tag>`. GitHub disabled both repositories on May 19 but did not rewrite or remove the tags. On September 16, 2026, between 09:09 and 16:16 UTC, both repositories became accessible again. The reason has not been disclosed.

[Socket](https://socket.dev/blog/mini-shai-hulud-actions) found the reactivation in workflow run histories. Jobs that had been failing in two seconds with "Repository access blocked" suddenly ran for nine to eleven minutes and downloaded `actions-cool/issues-helper@v2.2.1`. Its September 24 report notes that `issues-helper` alone has about 15,000 dependent repositories in GitHub's dependency graph. Socket has not determined how many of them reference the action by a mutable tag. The same day, [SafeDep](https://safedep.io/mini-shai-hulud-reinfection-github-repositories/) documented six newly infected repositories between September 20 and 24, including `ant-design/pro-components`, `jd-opensource/micro-app` and `MaaXYZ/MaaFramework`. It reports the payload is byte-identical to the May build. Socket's September 25 update says both actions were disabled again. The [repository page](https://github.com/actions-cool/issues-helper) now says access "has been disabled by GitHub Staff due to a violation of GitHub's terms of service."

## Who is affected

Any workflow that calls either action by tag (`@v2.1.1`, `@v2.2.0`, `@v2.2.1`, `@v3` and so on) and ran while the repositories were live. These are issue-housekeeping bots that run daily or on issue events, so most affected workflows probably fired within a day. The malicious `action.yml` installs Bun, runs the obfuscated `index.js`, then calls the real action so the step still passes. On the runner, SafeDep found that it reads the job's `ghs_` token from runner memory. It then commits `.claude/settings.json` (a `SessionStart` hook), `.vscode/tasks.json`, `.claude/setup.mjs` and `.claude/index.js` into the repository through the GraphQL API, so the commits appear verified as `github-actions[bot]`. A developer who later pulls and opens that repository in Claude Code or VS Code runs the worm locally. On developer machines it installs the `kitty-monitor` backdoor and can install the token monitor and its wiper. The May payload itself is covered in our earlier Mini Shai-Hulud brief.

## Do you really need to act?

Only if you use these actions, and that takes one search to confirm. If you referenced them by tag and a run succeeded on or after September 16, treat it as a live compromise of that repository's secrets and default branch. Pinning to a commit SHA helps only if that commit is clean: every tag now resolves to attacker commits such as `a0c53dd42fc8` (`v2.2.1`), so pin only a SHA you have verified predates May 18. The second disablement stopped new runs, but hook files already committed stay in place. SafeDep found all six infected default branches still carried them. The general lesson, which [GitHub's own guidance](https://docs.github.com/en/actions/reference/security/secure-use) repeats, is that tags are mutable and a disabled repository can come back.

## What to do now

1. Find references: `grep -rnE 'actions-cool/(issues-helper|maintain-one-comment)@' .github/workflows/`, or use GitHub code search across your org. Remove the actions or replace them.
2. Rotate every secret the affected workflows could read, plus deploy keys and package-registry tokens. Review the job's `GITHUB_TOKEN` permissions and set `permissions:` to the minimum.
3. Revert injected files: `git log --since=2026-09-16 --stat -- .claude .vscode/tasks.json`, then remove the hooks and force fresh clones for contributors.
4. On developer machines that opened an infected checkout, remove `gh-token-monitor` and `kitty-monitor` persistence *before* revoking GitHub tokens, then rotate local credentials.
5. Pin all third-party actions to full-length commit SHAs and review updates before bumping them.

## How to tell if you were hit

In the Actions run history, look for the pattern Socket describes: quick setup failures through September 15, then a long successful run on September 16. Job logs that show `oven-sh/setup-bun` or `bun run $GITHUB_ACTION_PATH/index.js` inside the action step confirm execution. On the repository side, look for unexpected `github-actions[bot]` commits adding `.claude/` or `.vscode/tasks.json`. A commit message copied from its parent is another sign: in `pro-components`, both read `3.1.14-7`. SafeDep lists the payload blob `2931c1be43b0`, the exfiltration host `t.m-kosche.com` and commit markers `firedalazer` and `thebeautifulmarchoftime`.

## Timeline

- May 18, 2026 — All tags of both actions are moved to malicious commits (19:10 to 19:31 UTC).
- May 19, 2026 — GitHub disables both repositories, leaving the tags unchanged.
- Sep 16, 2026 — Both repositories become accessible again, and tag-referencing workflows resume running the payload.
- Sep 20–24, 2026 — SafeDep records six newly infected repositories.
- Sep 24, 2026 — Socket and SafeDep publish their findings.
- Sep 25, 2026 — Both actions are disabled again. [BleepingComputer](https://www.bleepingcomputer.com/news/security/github-actions-re-enabled-with-mini-shai-hulud-payload-still-active/) and [The Hacker News](https://thehackernews.com/2026/09/compromised-github-actions-came-back.html) report the reactivation.

## Sources

1. [Socket — Re-enabled GitHub Actions expose thousands of repositories to Mini Shai-Hulud](https://socket.dev/blog/mini-shai-hulud-actions)
2. [SafeDep — Mini Shai-Hulud is still infecting GitHub repositories](https://safedep.io/mini-shai-hulud-reinfection-github-repositories/)
3. [GitHub — actions-cool/issues-helper (repository disabled by GitHub Staff)](https://github.com/actions-cool/issues-helper)
4. [GitHub — actions-cool/maintain-one-comment (repository disabled by GitHub Staff)](https://github.com/actions-cool/maintain-one-comment)
5. [GitHub Docs — Secure use reference: pin actions to a full-length commit SHA](https://docs.github.com/en/actions/reference/security/secure-use)
6. [The Hacker News — Compromised GitHub Actions came back online and resumed executing Mini Shai-Hulud malware](https://thehackernews.com/2026/09/compromised-github-actions-came-back.html)
7. [BleepingComputer — GitHub Actions re-enabled with Mini Shai-Hulud payload still active](https://www.bleepingcomputer.com/news/security/github-actions-re-enabled-with-mini-shai-hulud-payload-still-active/)

---
Source page: https://erroneo.us/security/briefs/actions-cool-mini-shai-hulud-reactivation/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt