# Re-Enabled actions-cool GitHub Actions (issues-helper, maintain-one-comment) Resume Executing Mini Shai-Hulud CI/CD Credential-Theft Payload

> The compromised GitHub Actions actions-cool/issues-helper (~15,000 dependent repositories) and actions-cool/maintain-one-comment, disabled by GitHub on 2026-05-19 after every release tag was redirected to an imposter commit harvesting CI/CD secrets from the Runner.Worker process, were re-enabled by their maintainer on 2026-09-16 without cleaning up the malicious tags. Any workflow still referencing either action by version tag (rather than a pinned commit SHA) silently resumed downloading Bun and executing the same Mini Shai-Hulud credential-stealer for over a week before Socket detected it and GitHub disabled both repositories again on 2026-09-25.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2661
- **ID:** TL-2026-2661
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-05-18 (19:10:24Z-19:13:40Z for issues-helper, 19:30:30Z-19:31:09Z for maintain-one-comment), an attacker compromised both GitHub Actions maintained under the actions-cool GitHub organization and rewrote every existing release tag (53 tags on issues-helper, 15 on maintain-one-comment) to point at a single 'imposter commit' — a commit reachable only via the rewritten tags, absent from the repositories' normal commit history on the default branch. The imposter commit embedded an obfuscated payload in index.js that, when the action ran inside a GitHub Actions workflow, downloaded the Bun JavaScript runtime to /home/runner/.bun/bin/bun and executed it via 'bun run $GITHUB_ACTION_PATH/index.js' ahead of the action's legitimate logic. The payload then read process memory of the Runner.Worker process (the GitHub Actions process that holds the workflow's decrypted secrets) via /proc/<PID>/mem, filtered the dump for fields marked isSecret:true, attempted privilege escalation via sudo python3 and gh auth token, and exfiltrated the harvested CI/CD credentials over HTTPS (port 443) to the attacker-controlled domain t.m-kosche.com. This exfiltration domain was also observed by researchers in the broader 'Mini Shai-Hulud' supply-chain campaign that, in a parallel wave beginning 2026-04-29 and escalating on 2026-05-11, published 637 malicious versions across 317 npm packages (including size-sensor, echarts-for-react, and the @antv scoped package tree) and PyPI packages via a CI cache-poisoning attack against npm's OIDC publishing endpoint, using a second C2 domain (git-tanstack.com) and, as a fallback exfiltration channel, the decentralized Session Protocol (getsession.org). GitHub disabled both actions-cool repositories on 2026-05-19 for terms-of-service violations, cutting off new downloads. Because the malicious release tags were never removed, however, the underlying repository content remained live: on 2026-09-16 between 09:09 and 16:16 UTC the actions-cool maintainer re-enabled both repositories without first cleaning the tags, so every workflow referencing either action by a mutable version tag (e.g. @v2.2.1, @v3.8.0) resumed pulling and executing the same May payload on its next scheduled or event-triggered run — requiring no further action from the threat actor. Only workflows already pinned to a full, verified commit SHA predating 2026-05-18 were unaffected. Socket researchers identified the still-active payload and published findings on 2026-09-25, after which GitHub disabled both actions-cool repositories a second time. issues-helper alone is listed as a dependency of roughly 15,000 repositories in GitHub's dependency graph; the number that actually executed the payload during either exposure window (tag-based references that ran a workflow in the affected periods) is undetermined. The overall payload and infrastructure are attributed by MITRE ATT&CK (Software S9043, 'Mini Shai-Hulud') to the group TeamPCP, previously linked to the March 2026 Trivy breach, which claimed authorship of the May 2026 npm wave of the same campaign; Mini Shai-Hulud is itself a descendant of the original 'Shai-Hulud' npm worm first reported in September 2025 (MITRE ATT&CK Software S9008).

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1059.007 JavaScript
- T1677 Poisoned Pipeline Execution
- T1071.001 Web Protocols
- T1027.013 Encrypted/Encoded File
- T1036.005 Match Legitimate Resource Name or Location
- T1550.001 Application Access Token
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1003.007 Proc Filesystem
- T1119 Automated Collection
- T1213.003 Code Repositories
- T1567.001 Exfiltration to Code Repository
- T1485 Data Destruction

## Sources

- [GitHub Actions re-enabled with Mini Shai-Hulud payload still active](https://www.bleepingcomputer.com/news/security/github-actions-re-enabled-with-mini-shai-hulud-payload-still-active/)
- [Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud](https://socket.dev/blog/mini-shai-hulud-actions)
- [actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials](https://www.stepsecurity.io/blog/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltrates-ci-cd-credentials)
- [Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials](https://thehackernews.com/2026/05/github-actions-supply-chain-attack.html)
- [Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware](https://thehackernews.com/2026/09/compromised-github-actions-came-back.html)
- [Compromised GitHub Actions re-enabled, posing supply chain risks](https://www.scworld.com/brief/compromised-github-actions-re-enabled-posing-supply-chain-risks)
- [When a Trusted GitHub Action Quietly Becomes Malicious Again](https://expertinthecloud.co.za/when-a-trusted-github-action-quietly-becomes-malicious-again/)
- [Mini Shai-Hulud: The Worm Returns and Goes Public](https://www.akamai.com/blog/security-research/mini-shai-hulud-worm-returns-goes-public)
- [Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised](https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised)
- [Mini Shai-Hulud, Software S9043](https://attack.mitre.org/software/S9043/)
- [Shai-Hulud, Software S9008](https://attack.mitre.org/software/S9008/)
- [Supply Chain Attack Affecting Numerous npm and PyPI Packages](https://digital.nhs.uk/cyber-alerts/2026/cc-4781)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2661