Two GitHub Actions returned with malicious code still reachable
Teams that invoked the affected actions may need to check whether workflow-accessible credentials were exposed.
Two repositories containing the compromised actions `actions-cool/issues-helper` and `actions-cool/maintain-one-comment` became reachable again between September 16 and 25, even though their release tags still led to the malicious payload. That exposed workflows configured with version tags to running the May code, while Socket noted GitHub’s dependency graph showed about 15,000 repositories relying on `issues-helper`—not evidence that all were affected. The May Mini Shai-Hulud campaign had infected 323 npm packages and 639 package versions with malware seeking developers’ tokens, credentials and CI/CD secrets. Socket found both actions unavailable again on September 25, causing workflows that referenced them to fail instead of running the payload. Developers should remove the actions or use a verified clean commit, inspect runs from September 16 onward, and rotate secrets available to workflows that ran an affected tag, Socket said.
Why it matters
For teams using these actions, the risk is not limited to interrupted automation: a workflow may have run code designed to seek credentials and secrets. Socket advised checking affected runs and rotating secrets available to them. With the actions disabled again, workflows that reference them fail instead of running the payload.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.