GitHub Actions rerun Mini Shai-Hulud malware

Two actions-cool GitHub Actions were disabled again after their repositories became reachable on 16 September 2026. GitHub’s notice said access had been blocked because of a terms-of-service breach.

Socket researcher Karlo Zanki said the release tags had not been cleaned up and still pointed to malicious code introduced on 18 May 2026. He said any workflow that used a version tag would fetch and run the payload again on its next execution.

The original compromise on 18 May 2026 was used to collect sensitive credentials from CI/CD pipelines and send them to an attacker-controlled server. Socket linked that activity to the Mini Shai-Hulud cluster because of overlap in the exfiltration domain and npm packages from the @antv ecosystem.

Socket said the actions handled issue and comment maintenance, including closing inactive issues and keeping a bot comment updated. It said many affected repositories probably ran the payload within a day of the repos reopening because the workflows ran on schedules or when issues or pull requests were opened.

Socket said repositories pinned to a full commit SHA from before 18 May 2026 were not affected. It advised finding every reference, removing the actions, pinning to a known-clean SHA, rotating exposed secrets, checking workflow run history, and reviewing repository history after 16 September 2026.