Re-Enabled actions-cool GitHub Actions (issues-helper, maintain-one-comment) Resume Executing Mini Shai-Hulud CI/CD Credential-Theft Payload

Re-Enabled actions-cool GitHub Actions (issues-helper (TL-2026-2661), also tracked as Mini Shai-Hulud GitHub Actions Re-Enablement, is a high-severity supply-chain compromise, first published 2026-09-26. It is attributed to TeamPCP with medium confidence, affects actions-cool issues-helper (GitHub Action), maps to 14 MITRE ATT&CK techniques (T1003.007, T1027.013, T1036.005), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-2661

Threat ID
TL-2026-2661
Also known as
Mini Shai-Hulud GitHub Actions Re-Enablement, actions-cool Supply Chain Attack
Severity
HIGH
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-09-26
Last reviewed
2026-09-26
Attribution
TeamPCP
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
technology, software-development
Target regions
Global
Detection rules
9
Indicators of compromise
19

Malware and tooling in Re-Enabled actions-cool GitHub Actions (issues-helper

Malware and tooling: Mini Shai-Hulud, One, Shai-Hulud, Bun JavaScript runtime, StepSecurity Harden-Runner

The compromised GitHub Actions actions-cool/issues-helper (~15,000 dependent repositories) and actions-cool/maintain-one-comment, disabled by GitHub on 2026-05-19 after every release tag was redirected to an imposter commit harvesting CI/CD secrets from the Runner.Worker process, were re-enabled by their maintainer on 2026-09-16 without cleaning up the malicious tags. Any workflow still referencing either action by version tag (rather than a pinned commit SHA) silently resumed downloading Bun and executing the same Mini Shai-Hulud credential-stealer for over a week before Socket detected it and GitHub disabled both repositories again on 2026-09-25.

How Re-Enabled actions-cool GitHub Actions (issues-helper works

On 2026-05-18 (19:10:24Z-19:13:40Z for issues-helper, 19:30:30Z-19:31:09Z for maintain-one-comment), an attacker compromised both GitHub Actions maintained under the actions-cool GitHub organization and rewrote every existing release tag (53 tags on issues-helper, 15 on maintain-one-comment) to point at a single 'imposter commit' — a commit reachable only via the rewritten tags, absent from the repositories' normal commit history on the default branch. The imposter commit embedded an obfuscated payload in index.js that, when the action ran inside a GitHub Actions workflow, downloaded the Bun JavaScript runtime to /home/runner/.bun/bin/bun and executed it via 'bun run $GITHUB_ACTION_PATH/index.js' ahead of the action's legitimate logic. The payload then read process memory of the Runner.Worker process (the GitHub Actions process that holds the workflow's decrypted secrets) via /proc/<PID>/mem, filtered the dump for fields marked isSecret:true, attempted privilege escalation via sudo python3 and gh auth token, and exfiltrated the harvested CI/CD credentials over HTTPS (port 443) to the attacker-controlled domain t.m-kosche.com. This exfiltration domain was also observed by researchers in the broader 'Mini Shai-Hulud' supply-chain campaign that, in a parallel wave beginning 2026-04-29 and escalating on 2026-05-11, published 637 malicious versions across 317 npm packages (including size-sensor, echarts-for-react, and the @antv scoped package tree) and PyPI packages via a CI cache-poisoning attack against npm's OIDC publishing endpoint, using a second C2 domain (git-tanstack.com) and, as a fallback exfiltration channel, the decentralized Session Protocol (getsession.org). GitHub disabled both actions-cool repositories on 2026-05-19 for terms-of-service violations, cutting off new downloads. Because the malicious release tags were never removed, however, the underlying repository content remained live: on 2026-09-16 between 09:09 and 16:16 UTC the actions-cool maintainer re-enabled both repositories without first cleaning the tags, so every workflow referencing either action by a mutable version tag (e.g. @v2.2.1, @v3.8.0) resumed pulling and executing the same May payload on its next scheduled or event-triggered run — requiring no further action from the threat actor. Only workflows already pinned to a full, verified commit SHA predating 2026-05-18 were unaffected. Socket researchers identified the still-active payload and published findings on 2026-09-25, after which GitHub disabled both actions-cool repositories a second time. issues-helper alone is listed as a dependency of roughly 15,000 repositories in GitHub's dependency graph; the number that actually executed the payload during either exposure window (tag-based references that ran a workflow in the affected periods) is undetermined. The overall payload and infrastructure are attributed by MITRE ATT&CK (Software S9043, 'Mini Shai-Hulud') to the group TeamPCP, previously linked to the March 2026 Trivy breach, which claimed authorship of the May 2026 npm wave of the same campaign; Mini Shai-Hulud is itself a descendant of the original 'Shai-Hulud' npm worm first reported in September 2025 (MITRE ATT&CK Software S9008).

MITRE ATT&CK techniques used in TL-2026-2661

Credential Access

T1003.007 Proc Filesystem; T1528 Steal Application Access Token; T1552.001 Credentials In Files

Defense Evasion

T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.007 JavaScript; T1677 Poisoned Pipeline Execution

Command and Control

T1071.001 Web Protocols

Collection

T1119 Automated Collection; T1213.003 Code Repositories

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools

Impact

T1485 Data Destruction

lateral-movement

T1550.001 Application Access Token

Exfiltration

T1567.001 Exfiltration to Code Repository

Affected products and versions in Re-Enabled actions-cool GitHub Actions (issues-helper

  • actions-cool — issues-helper (GitHub Action)
    Vulnerable versions: all release tags up to and including v3.8.0, tag-redirected on 2026-05-18 and re-exposed 2026-09-16 through 2026-09-25
    Fixed in: none published; safe use requires pinning to a verified commit SHA predating 2026-05-18 or removing the action entirely
  • actions-cool — maintain-one-comment (GitHub Action)
    Vulnerable versions: all release tags up to and including v3.3.0, tag-redirected on 2026-05-18 and re-exposed 2026-09-16 through 2026-09-25
    Fixed in: none published; safe use requires pinning to a verified commit SHA predating 2026-05-18 or removing the action entirely

Remediation for Re-Enabled actions-cool GitHub Actions (issues-helper

Patches

  • None — no patched release of either action exists; GitHub disabled both actions-cool repositories a second time on 2026-09-25 with no cleanup of the malicious tags confirmed

Immediate actions

  • Grep every .github/workflows/*.yml across all repositories for references to actions-cool/issues-helper or actions-cool/maintain-one-comment
  • Remove or replace any workflow step referencing either action by a mutable version tag (e.g. @v2.2.1, @v3.8.0) rather than a full commit SHA
  • Rotate every secret exposed to a workflow that referenced either action between 2026-05-18 and 2026-09-25 (GITHUB_TOKEN-derived tokens, cloud credentials, npm/PyPI tokens, SSH keys, webhook secrets)
  • Review GitHub Actions run logs for the affected windows for unexpected 'bun' process spawns, /home/runner/.bun/bin/bun, sudo python3 invocations, gh auth token calls, or outbound HTTPS connections to t.m-kosche.com

Workarounds

  • Replace actions-cool/issues-helper and actions-cool/maintain-one-comment with equivalent native GitHub Actions functionality, or fork and pin to a verified clean commit predating 2026-05-18

Longer-term hardening

  • Pin every third-party GitHub Action used in CI/CD workflows to a full 40-character commit SHA, never a mutable tag or branch reference
  • Deploy a CI/CD runtime security control (e.g. StepSecurity Harden-Runner or equivalent) capable of detecting imposter-commit tag redirection and anomalous outbound network connections from runners
  • Track GitHub's dependency graph and third-party supply-chain intelligence (e.g. Socket) for re-activation of previously disabled/compromised Actions before trusting a repository's re-enablement

Timeline of Re-Enabled actions-cool GitHub Actions (issues-helper

  • Original 'Shai-Hulud' npm worm first reported, compromising 500+ npm packages via phishing-driven maintainer token theft (approximate month; precise day not specified in sources) — direct predecessor tracked as MITRE ATT&CK Software S9008.
  • The 'Mini Shai-Hulud' campaign begins, using a shared payload architecture (preinstall/import-time hook downloading a platform-specific Bun runtime and executing an obfuscated ~11.7MB credential stealer) across npm and PyPI.
  • TeamPCP publishes 637 malicious versions across 317 npm packages (including size-sensor, echarts-for-react, and @antv scoped packages) in a 22-minute automated burst via CI cache-poisoning of npm's OIDC publishing endpoint.
  • actions-cool/issues-helper (53 tags, 19:10:24Z-19:13:40Z) and actions-cool/maintain-one-comment (15 tags, 19:30:30Z-19:31:09Z) have every release tag redirected to an imposter commit embedding the Mini Shai-Hulud payload in index.js.
  • GitHub disables both actions-cool repositories for terms-of-service violations, cutting off new downloads of the malicious tags.
  • Workflows referencing either action by mutable version tag automatically resume downloading Bun and executing the Mini Shai-Hulud credential-theft payload on their next scheduled or event-triggered run, exfiltrating secrets to t.m-kosche.com.
  • The actions-cool maintainer re-enables both repositories between 09:09 and 16:16 UTC without cleaning up the malicious release tags, which still resolve to the May imposter commits.
  • GitHub disables both actions-cool repositories a second time following Socket's disclosure.
  • Socket researchers identify the still-active payload in the re-enabled repositories and publish findings documenting the ongoing compromise.
  • BleepingComputer and other outlets publish coverage of the re-enablement incident, highlighting the ~15,000 repositories dependent on issues-helper and the gap in supply-chain remediation practices it exposed.

Sources cited for Re-Enabled actions-cool GitHub Actions (issues-helper

More in supply chain

Detection coverage for TL-2026-2661

As of 2026-09-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2661 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2661

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats