Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Brief
Update, September 25, 2026 : both actions-cool/issues-helper and actions-cool/maintain-one-comment have been disabled on GitHub again, so workflows referencing them now fail at job setup instead of running the payload.
Two actions-cool GitHub Actions, issues-helper and maintain-one-comment , were compromised and disabled during the May 2026 Mini Shai-Hulud campaign. Both became reachable again on September 16, 2026, and their release tags still point to malicious code, so every workflow that references either one by tag rather than by commit SHA is running the payload again.
The GitHub Actions actions-cool/issues-helper and actions-cool/maintain-one-comment were compromised in the May 2026 Mini Shai-Hulud campaign . GitHub security team disabled both repositories on May 19, 2026, one day after the malicious content was introduced.