GitHub Actions briefly reactivated with old Mini Shai-Hulud payload

Two previously abused actions were live again for nine days, leaving workflows exposed until GitHub disabled them once more.

The maintainer of two GitHub Actions tied to the May Mini Shai-Hulud campaign restored them on September 16, even though their release tags still led to the earlier malicious code; workflows using those tags could run it again. Socket found the payload in obfuscated form in index.js, and GitHub disabled both actions again on September 25, causing affected workflows to fail instead of execute the code. The May campaign infected 323 npm packages and 639 package versions with malware targeting developers’ tokens, credentials and CI/CD secrets. GitHub’s dependency graph lists about 15,000 repositories using issues-helper, but Socket has not determined how many dependents used mutable tags, and that count does not show how many were compromised. Socket advises teams to remove the actions or pin a verified clean commit, review runs from September 16 onward and rotate secrets available to workflows that ran an affected tag.