Re-Enabled actions-cool GitHub Actions (issues-helper, maintain-one-comment) Resume Executing Mini Shai-Hulud CI/CD Credential-Theft Payload

Key facts

Detection coverage

As of 2026-09-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2661 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Splunk: GitHub Actions Workflow Invokes actions-cool Action by Mutable Tag or Imposter Commit

Detects a GitHub Actions workflow run referencing actions-cool/issues-helper or actions-cool/maintain-one-comment either by a mutable version tag (not pinned to a full commit SHA) or directly by one of the known imposter commit SHAs that every release tag was redirected to on 2026-05-18 and that resumed executing on re-enablement on 2026-09-16. This is the initial-access trigger for the Mini Shai-Hulud CI/CD credential-theft payload.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.001, T1677, T1036.005
• Data sources: github_audit_log, github_actions_workflow_run_log, cicd_pipeline_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=github_audit sourcetype IN ("github:workflow_run", "github:audit") 
| rex field=_raw "uses:\s*actions-cool/(?<gh_action>issues-helper|maintain-one-comment)@(?<gh_ref>[A-Za-z0-9\.\-_]+)"
| where isnotnull(gh_action)
| eval is_full_sha=if(match(gh_ref, "^[0-9a-f]{40}$"), 1, 0)
| eval is_imposter_commit=if(match(gh_ref, "^(a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d|1c9e803c80cc7fed000022d4c94f4b5bc2e90062|7f6120bb10c870b9fde146961a18e5bf0b3d4401)$"), 1, 0)
| where is_imposter_commit=1 OR is_full_sha=0
| stats count min(_time) as first_seen max(_time) as last_seen values(gh_ref) as refs_used by repo_name, workflow_name, actor
| where count > 0

Microsoft KQL

GitHubActionsRun_CL
| where TimeGenerated > ago(24h)
| where WorkflowStep_s has_any ("actions-cool/issues-helper", "actions-cool/maintain-one-comment")
| extend ActionRef = extract(@"actions-cool/(issues-helper|maintain-one-comment)@([A-Za-z0-9\.\-_]+)", 2, WorkflowStep_s)
| extend IsFullSha = iff(ActionRef matches regex @"^[0-9a-f]{40}$", true, false)
| extend IsImposterCommit = ActionRef in ("a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d","1c9e803c80cc7fed000022d4c94f4b5bc2e90062","7f6120bb10c870b9fde146961a18e5bf0b3d4401")
| where IsImposterCommit or not(IsFullSha)
| project TimeGenerated, RepositoryName_s, WorkflowName_s, ActorLogin_s, ActionRef, IsImposterCommit
| summarize Count=count(), Refs=make_set(ActionRef) by RepositoryName_s, WorkflowName_s, ActorLogin_s

Sigma

title: GitHub Actions Workflow References Compromised actions-cool Action by Mutable Tag or Imposter Commit
id: e4a1b2c3-4d5e-4f6a-8b7c-9d0e1f2a3b4c
status: experimental
description: Detects a GitHub Actions workflow run invoking actions-cool/issues-helper or actions-cool/maintain-one-comment by a mutable version tag or by a known imposter commit SHA tied to the Mini Shai-Hulud CI/CD credential-theft payload re-activated 2026-09-16.
references:
    - https://socket.dev/blog/mini-shai-hulud-actions
    - https://attack.mitre.org/software/S9043/
author: Threadlinqs Team
date: 2026-09-26
tags:
    - attack.initial-access
    - attack.t1195.001
    - attack.execution
    - attack.t1677
    - attack.defense-evasion
    - attack.t1036.005
    - attack.tool.mini_shai_hulud
logsource:
    category: application
    product: github
    service: actions
detection:
    selection_action:
        action_uses|contains:
            - 'actions-cool/issues-helper@'
            - 'actions-cool/maintain-one-comment@'
    selection_imposter_sha:
        action_ref:
            - 'a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d'
            - '1c9e803c80cc7fed000022d4c94f4b5bc2e90062'
            - '7f6120bb10c870b9fde146961a18e5bf0b3d4401'
    filter_pinned_sha:
        action_ref|re: '^[0-9a-f]{40}$'
    condition: (selection_action and not filter_pinned_sha) or selection_imposter_sha
falsepositives:
    - Workflows already migrated to a verified clean pinned commit SHA predating 2026-05-18 that is not one of the listed imposter commits
level: high

Known false positives:

• Repositories that migrated to a verified clean pinned commit SHA before 2026-05-18 and never reference the redirected tags or imposter commits will match the SHA-length filter but not the imposter-commit list — confirm any 40-char SHA hit against the published imposter commit list before escalating

Tuning notes: Extend the imposter-commit SHA allowlist/blocklist as Socket/StepSecurity publish additional redirected tags; cross-reference alerting repos against your org's SBOM/Dependabot inventory of the ~15,000 issues-helper dependents to prioritize triage.

• 🔒 Sentinel: actions-cool GitHub Action Referenced Without Commit-SHA Pinning · unlock with TL Creds
• 🔒 Sentinel: Mini Shai-Hulud Bun Payload and Runner.Worker Memory Scraping · unlock with TL Creds
• 🔒 Sentinel: DeviceNetworkEvents/DNS Hits on Mini Shai-Hulud Exfiltration Domains · unlock with TL Creds
• 🔒 Sigma: Compromised actions-cool GitHub Action Used by Tag or Imposter Commit · unlock with TL Creds
• 🔒 Sigma: Bun-Based Credential-Theft Execution Chain (Mini Shai-Hulud) · unlock with TL Creds
• 🔒 Sigma: DNS/Network Resolution of Mini Shai-Hulud Exfiltration Domains · unlock with TL Creds
• 🔒 Splunk: Bun-Runtime Credential-Harvesting Chain on GitHub Actions Runner · unlock with TL Creds
• 🔒 Splunk: Outbound Connection to Mini Shai-Hulud Credential-Exfiltration Infrastructure · unlock with TL Creds

Indicators of compromise

As of 2026-09-26, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2661.

Sample indicators (3 of 19)

• Domain: t[.]m-kosche[.]com
• File hash: a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d
• Domain: git-tanstack[.]com

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

Community OSINT corroboration

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

Any workflow still referencing either action by version tag (rather than a pinned commit SHA) silently resumed downloading Bun and executing the same Mini Shai-Hulud credential-stealer for over a week before Socket detected it and GitHub disabled both repositories again on 2026-09-25.

On 2026-05-18 (19:10:24Z-19:13:40Z for issues-helper, 19:30:30Z-19:31:09Z for maintain-one-comment), an attacker compromised both GitHub Actions maintained under the actions-cool GitHub organization and rewrote every existing release tag (53 tags on issues-helper, 15 on maintain-one-comment) to point at a single 'imposter commit' — a commit reachable only via the rewritten tags, absent from the repositories' normal commit history on the default branch. The imposter commit embedded an obfuscated payload in index.js that, when the action ran inside a GitHub Actions workflow, downloaded the Bun JavaScript runtime to /home/runner/.bun/bin/bun and executed it via 'bun run $GITHUB_ACTION_PATH/index.js' ahead of the action's legitimate logic. The payload then read process memory of the Runner.Worker process (the GitHub Actions process that holds the workflow's decrypted secrets) via /proc/<PID>/mem, filtered the dump for fields marked isSecret:true, attempted privilege escalation via sudo python3 and gh auth token, and exfiltrated the harvested CI/CD credentials over HTTPS (port 443) to the attacker-controlled domain t.m-kosche.com. This exfiltration domain was also observed by researchers in the broader 'Mini Shai-Hulud' supply-chain campaign that, in a parallel wave beginning 2026-04-29 and escalating on 2026-05-11, published 637 malicious versions across 317 npm packages (including size-sensor, echarts-for-react, and the @antv scoped package tree) and PyPI packages via a CI cache-poisoning attack against npm's OIDC publishing endpoint, using a second C2 domain (git-tanstack.com) and, as a fallback exfiltration channel, the decentralized Session Protocol (getsession.org). GitHub disabled both actions-cool repositories on 2026-05-19 for terms-of-service violations, cutting off new downloads. Because the malicious release tags were never removed, however, the underlying repository content remained live: on 2026-09-16 between 09:09 and 16:16 UTC the actions-cool maintainer re-enabled both repositories without first cleaning the tags, so every workflow referencing either action by a mutable version tag (e.g. @v2.2.1, @v3.8.0) resumed pulling and executing the same May payload on its next scheduled or event-triggered run — requiring no further action from the threat actor. Only workflows already pinned to a full, verified commit SHA predating 2026-05-18 were unaffected. Socket researchers identified the still-active payload and published findings on 2026-09-25, after which GitHub disabled both actions-cool repositories a second time. issues-helper alone is listed as a dependency of roughly 15,000 repositories in GitHub's dependency graph; the number that actually executed the payload during either exposure window (tag-based references that ran a workflow in the affected periods) is undetermined. The overall payload and infrastructure are attributed by MITRE ATT&CK (Software S9043, 'Mini Shai-Hulud') to the group TeamPCP, previously linked to the March 2026 Trivy breach, which claimed authorship of the May 2026 npm wave of the same campaign; Mini Shai-Hulud is itself a descendant of the original 'Shai-Hulud' npm worm first reported in September 2025 (MITRE ATT&CK Software S9008).

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.007 Proc Filesystem; T1528 Steal Application Access Token; T1552.001 Credentials In Files

Defense Evasion

T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.007 JavaScript; T1677 Poisoned Pipeline Execution

Command and Control

T1071.001 Web Protocols

Collection

T1119 Automated Collection; T1213.003 Code Repositories

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools

Impact

T1485 Data Destruction

lateral-movement

T1550.001 Application Access Token

Exfiltration

T1567.001 Exfiltration to Code Repository

Remediation

Patches

• None — no patched release of either action exists; GitHub disabled both actions-cool repositories a second time on 2026-09-25 with no cleanup of the malicious tags confirmed

Immediate actions

• Grep every .github/workflows/*.yml across all repositories for references to actions-cool/issues-helper or actions-cool/maintain-one-comment
• Remove or replace any workflow step referencing either action by a mutable version tag (e.g. @v2.2.1, @v3.8.0) rather than a full commit SHA
• Rotate every secret exposed to a workflow that referenced either action between 2026-05-18 and 2026-09-25 (GITHUB_TOKEN-derived tokens, cloud credentials, npm/PyPI tokens, SSH keys, webhook secrets)
• Review GitHub Actions run logs for the affected windows for unexpected 'bun' process spawns, /home/runner/.bun/bin/bun, sudo python3 invocations, gh auth token calls, or outbound HTTPS connections to t.m-kosche.com

Workarounds

• Replace actions-cool/issues-helper and actions-cool/maintain-one-comment with equivalent native GitHub Actions functionality, or fork and pin to a verified clean commit predating 2026-05-18

Longer-term hardening

• Pin every third-party GitHub Action used in CI/CD workflows to a full 40-character commit SHA, never a mutable tag or branch reference
• Deploy a CI/CD runtime security control (e.g. StepSecurity Harden-Runner or equivalent) capable of detecting imposter-commit tag redirection and anomalous outbound network connections from runners
• Track GitHub's dependency graph and third-party supply-chain intelligence (e.g. Socket) for re-activation of previously disabled/compromised Actions before trusting a repository's re-enablement

Affected and fixed versions

• actions-cool — issues-helper (GitHub Action)
  Vulnerable versions: all release tags up to and including v3.8.0, tag-redirected on 2026-05-18 and re-exposed 2026-09-16 through 2026-09-25
  Fixed in: none published; safe use requires pinning to a verified commit SHA predating 2026-05-18 or removing the action entirely
• actions-cool — maintain-one-comment (GitHub Action)
  Vulnerable versions: all release tags up to and including v3.3.0, tag-redirected on 2026-05-18 and re-exposed 2026-09-16 through 2026-09-25
  Fixed in: none published; safe use requires pinning to a verified commit SHA predating 2026-05-18 or removing the action entirely

Timeline

• 2025-09-01 Original 'Shai-Hulud' npm worm first reported, compromising 500+ npm packages via phishing-driven maintainer token theft (approximate month; precise day not specified in sources) — direct predecessor tracked as MITRE ATT&CK Software S9008.
• 2026-04-29 The 'Mini Shai-Hulud' campaign begins, using a shared payload architecture (preinstall/import-time hook downloading a platform-specific Bun runtime and executing an obfuscated ~11.7MB credential stealer) across npm and PyPI.
• 2026-05-11 TeamPCP publishes 637 malicious versions across 317 npm packages (including size-sensor, echarts-for-react, and @antv scoped packages) in a 22-minute automated burst via CI cache-poisoning of npm's OIDC publishing endpoint.
• 2026-05-18 actions-cool/issues-helper (53 tags, 19:10:24Z-19:13:40Z) and actions-cool/maintain-one-comment (15 tags, 19:30:30Z-19:31:09Z) have every release tag redirected to an imposter commit embedding the Mini Shai-Hulud payload in locked-ioc-9.
• 2026-05-19 GitHub disables both actions-cool repositories for terms-of-service violations, cutting off new downloads of the malicious tags.
• 2026-09-16 Workflows referencing either action by mutable version tag automatically resume downloading Bun and executing the Mini Shai-Hulud credential-theft payload on their next scheduled or event-triggered run, exfiltrating secrets to locked-ioc-7.
• 2026-09-16 The actions-cool maintainer re-enables both repositories between 09:09 and 16:16 UTC without cleaning up the malicious release tags, which still resolve to the May imposter commits.
• 2026-09-25 GitHub disables both actions-cool repositories a second time following Socket's disclosure.
• 2026-09-25 Socket researchers identify the still-active payload in the re-enabled repositories and publish findings documenting the ongoing compromise.
• 2026-09-26 BleepingComputer and other outlets publish coverage of the re-enablement incident, highlighting the ~15,000 repositories dependent on issues-helper and the gap in supply-chain remediation practices it exposed.

Sources cited

• Supply Chain Attack Affecting Numerous npm and PyPI Packages digital.nhs.uk · Advisory · 2026-05-14
• Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud socket.dev · Research · 2026-09-25
• actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials stepsecurity.io · Research · 2026-05-19
• Mini Shai-Hulud: The Worm Returns and Goes Public akamai.com · Vendor report · 2026-05-13
• Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised Wiz · Vendor report · 2026-05-12
• Mini Shai-Hulud, Software S9043 MITRE · Research · 2026-09-26
• Shai-Hulud, Software S9008 MITRE · Research · 2026-09-26
• When a Trusted GitHub Action Quietly Becomes Malicious Again expertinthecloud.co.za · Blog · 2026-09-25
• GitHub Actions re-enabled with Mini Shai-Hulud payload still active BleepingComputer · News · 2026-09-26
• Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials The Hacker News · News · 2026-05-19
• Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware The Hacker News · News · 2026-09-26
• Compromised GitHub Actions re-enabled, posing supply chain risks scworld.com · News · 2026-09-25

More in supply chain

• Compromised GitHub Accounts Push CI Secret Stealer to Tens of Thousands of Repositories (November 2026 Wave)
• Why SBOMs Are Failing to Stop Supply Chain Attacks: XZ Utils Backdoor (CVE-2024-3094) and Axios npm Compromise (March 2026) as Case Studies
• Software Supply Chain Attacks Weaponizing Trusted Developer Workflows (Shai-Hulud, Miasma, Hades, TeamPCP)
• Active ScreenConnect Attacks Breach MSPs via Run Command, Deploying Rogue ScreenConnect Clients Across Dozens of Organizations
• MCP Server Supply Chain Weaknesses (uvx/npx Unpinned Dependencies) Could Expose API Keys and Administrator Credentials

More from TeamPCP

• AI Is Both Target and Tool for Threat Actors: AI-Involved Supply-Chain, Malware and Extortion Trends (Insikt Group, Jul 2025 - Jul 2026)
• Developer credential exposure on dev machines: StepSecurity Dev Machine Guard credential-source inventory (context: TeamPCP stealer, Bitwarden CLI npm hijack, Shai-Hulud)
• Open Source Supply Chain Attack Surge: 56 Confirmed Attacks in 12 Months Across npm, PyPI, RubyGems, Composer, Rust Crates and GitHub Actions (Shai-Hulud, TeamPCP, Axios, Miasma, ChainDrop)
• Mini Shai-Hulud: Compromised @antv npm Packages Steal Developer and CI/CD Credentials (TeamPCP)
• Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)
• Open-Source Supply Chain Poisoning Campaigns Drive CrowdStrike Endpoint-Based Package Interception

Previous and next in supply chain

• PhantomSub: 101 Malicious npm Baileys Forks Force Developers' WhatsApp Accounts into Attacker-Controlled Groups/Channels Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages