Two GitHub Actions compromised in the May 2026 Mini Shai-Hulud campaign were re-enabled last week and started executing malware again before being disabled a second time.
You'd think a supply chain attack would be a one-and-done deal. Patch it, move on, right? Well, apparently not for two popular GitHub Actions that just got taken down for the second time in a matter of months.
Here's the short version: `actions-cool/issues-helper` and `actions-cool/maintain-one-comment` were compromised back during the May 2026 Mini Shai-Hulud campaign. The repos got disabled, everyone breathed a sigh of relief, and life went on. But last week, those same repositories quietly came back online — and according to reports, they started executing that same malicious code all over again.
Now, visiting either repo shows a pretty blunt message: "Access to this..." and then nothing. The doors are shut. Again.
### What Actually Happened Here?
Let's back up a second. Mini Shai-Hulud wasn't some fly-by-night operation. It was a coordinated supply chain attack that slipped malicious code into widely-used GitHub Actions — the kind of automation tools developers plug into their CI/CD pipelines without thinking twice.
That's the scary part. You trust these things. You add them to your workflow YAML, and they run on every push, every pull request, every release. If someone poisons that action, they're essentially sitting inside your build process.
The two affected actions here were pretty popular in the open-source community:
- `actions-cool/issues-helper` — used to automate issue management
- `actions-cool/maintain-one-comment` — keeps comment threads tidy on PRs
Neither one sounds dangerous, right? That's exactly the point.
### The Comeback Nobody Asked For
Here's where it gets weird. When the repos reappeared last week, they didn't just sit there quietly. Reports indicate the malicious code resumed executing — same Mini Shai-Hulud payload, same playbook. GitHub has since disabled them again, but the fact that they came back at all raises some uncomfortable questions.
How did they get re-enabled? Was it an oversight? A compromised maintainer account? An automated process that didn't check the right flags? Nobody's saying much yet, and honestly, that silence is louder than any statement could be.
### Why This Matters for Anyone Using CI/CD
If you're running GitHub Actions in your workflow — and let's be honest, who isn't these days — this should make you pause.
Here's the uncomfortable truth: supply chain attacks aren't going away. They're getting smarter, sneakier, and more patient. Mini Shai-Hulud didn't just hit and run. It came back for round two.
A few things worth doing right now:
- Audit your workflows. Check every action you're pulling in, especially third-party ones.
- Pin your actions to specific commit SHAs instead of version tags. Tags can be moved. SHAs can't.
- Watch for unexpected behavior in your build logs. Weird network calls, strange env variables — those are red flags.
- Follow security advisories. GitHub publishes them for a reason.
> "The most dangerous dependency is the one you forgot you had."
That quote hits different when you realize how many actions run silently in the background of your pipeline.
### What Comes Next
GitHub hasn't released a detailed postmortem yet, and the maintainers behind actions-cool haven't commented publicly. Until then, the safest move is simple: if you're using either of these actions, rip them out of your workflows immediately. Find alternatives. Or better yet, write your own if the functionality is simple enough.
The Mini Shai-Hulud saga isn't over. It's just on pause. And if history's any indicator, it'll be back — probably when we least expect it.
Stay paranoid. Pin your SHAs. And maybe double-check that action you added three years ago and forgot about.
