Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this

The report states that the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment repositories became accessible again on September 16, 2026, while release tags still pointed to malicious Mini Shai-Hulud content; workflows referencing those actions by version tag could therefore resume executing the payload. The repositories were subsequently disabled again. RealGround analysis: this is an AI supply-chain risk when affected CI/CD workflows build, deploy, or manage AI systems, and organizations should inventory transitive dependencies, prefer immutable commit-SHA pinning, inspect recent workflow runs and secrets, and continuously test third-party automation for malicious behavior.