Affected Systems

Two GitHub Actions repositories (actions-cool/issues-helper and actions-cool/maintain-one-comment) compromised in May 2026. Any CI/CD workflows referencing these actions by version tags (e.g., v2.2.1 or later from May 18, 2026) executed malicious payloads between September 16-25, 2026. Workflows pinned to full commit SHA from before May 18, 2026 are not affected.

Exploitation Status

Active exploitation confirmed. Repositories were re-enabled September 16, 2026, and malicious code from May 2026 compromise remained in release tags. Any workflow using affected actions by version tag automatically downloaded and executed credential-harvesting payload. Linked to Mini Shai-Hulud threat cluster with known exfiltration infrastructure (t.m-kosche[.]com).

Business Impact

Organizations using these GitHub Actions in CI/CD pipelines likely had secrets (API keys, tokens, credentials) harvested and exfiltrated between September 16-25, 2026. Most affected workflows run daily or on issue/PR events, meaning exposure occurred within 24 hours of re-enablement. This is a supply chain incident requiring no new attacker action—malicious code persisted in tags and reactivated when repositories became accessible. Credential rotation and incident response required for all affected pipelines.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all GitHub workflows for references to actions-cool/issues-helper and actions-cool/maintain-one-comment; treat any version v2.2.1 or later as compromised
  • Remove affected actions or pin to known-clean commit SHA from before May 18, 2026; do not use mutable version tags
  • Rotate all secrets, tokens, and credentials accessible to workflows that used these actions since September 16, 2026
  • Review workflow run history for newly successful runs after prolonged failures or unexpected activity between September 16-25, 2026
  • Audit repository commit history for unauthorized changes made after September 16, 2026, indicating potential follow-on compromise

---

# Threat Actor Context

Actor Profile

Mini Shai-Hulud is a supply chain threat activity cluster first identified in May 2026. The actor targets software development environments through compromise of widely-used open source components, specifically GitHub Actions workflows and npm packages. Attribution is based on infrastructure overlaps, particularly the shared exfiltration domain "t.m-kosche[.]com" used across GitHub Actions and npm @antv ecosystem compromises. The actor's motivation appears to be credential harvesting from CI/CD pipelines, enabling further supply chain attacks. The group demonstrates patience and operational sophistication, maintaining persistent access to compromised repositories and leveraging the trust model of package ecosystems.

TTPs (Tactics, Techniques, Procedures)

Initial Access: Compromise of legitimate GitHub Actions repositories (actions-cool/issues-helper and actions-cool/maintain-one-comment) on May 18, 2026, likely via account takeover or repository access compromise. Execution: Malicious code embedded in GitHub Actions workflows executes automatically when referenced by downstream CI/CD pipelines via mutable version tags (T1059 - Command and Scripting Interpreter). Credential Access: Harvesting of sensitive credentials and secrets from CI/CD pipeline environments during workflow execution (T1552.001 - Credentials In Files, T1552.004 - Private Keys). Collection: Automated collection of exposed secrets from multiple downstream repositories that reference the compromised actions. Exfiltration: Stolen credentials transmitted to attacker-controlled infrastructure at t.m-kosche[.]com (T1041 - Exfiltration Over C2 Channel). Persistence: Malicious code remained in repository release tags after initial containment, enabling automatic reactivation when repositories were re-enabled without cleanup (T1554 - Compromise Software Supply Chain).

Targets & Patterns

Mini Shai-Hulud primarily targets software development organizations and open source ecosystems. The compromised GitHub Actions (issues-helper and maintain-one-comment) are workflow automation tools for issue and comment management, commonly used by development teams across numerous repositories. Targeting these specific actions provides broad reach with minimal effort, as workflows typically run on daily schedules or trigger on issue/pull request events. The actor exploits the trust model inherent in open source supply chains, where developers routinely reference third-party actions via mutable tags rather than pinned commit SHAs. This targeting strategy enables mass credential harvesting from CI/CD environments across multiple organizations simultaneously. The overlap with npm @antv ecosystem compromises suggests the actor systematically targets high-impact, widely-adopted open source components to maximize downstream victim count and credential collection opportunities.

Historical Context

The Mini Shai-Hulud campaign was first identified in May 2026 when the two actions-cool GitHub Actions repositories were initially compromised on May 18, 2026. The activity cluster was linked to concurrent compromises of npm packages in the @antv ecosystem based on shared exfiltration infrastructure (t.m-kosche[.]com domain). Following discovery, the affected GitHub repositories were disabled by GitHub Staff for terms of service violations. On September 16, 2026, the repositories were unexpectedly re-enabled between 11:09 a.m. and 6:16 p.m. GMT+2, with the reason for re-enablement remaining unknown. Critically, the malicious release tags from the May 18 compromise were never cleaned up, allowing the threat to automatically reactivate without any new attacker action. This September 2026 incident represents a unique supply chain reactivation event where no new code publication, account hijacking, or configuration changes were required—the dormant malicious code simply resumed execution when repositories became accessible again.

Defensive Recommendations

  • Implement SHA pinning for all GitHub Actions dependencies by referencing full commit SHAs instead of mutable version tags (e.g., use commit SHA from before May 18, 2026 rather than @v2.2.1) to prevent automatic execution of compromised code
  • Immediately rotate all secrets and credentials that were accessible to CI/CD workflows referencing actions-cool/issues-helper or actions-cool/maintain-one-comment, particularly those that ran between September 16-25, 2026
  • Audit workflow run history for the affected actions, looking for newly successful runs after prolonged periods of failures, and review repository commit history for unexpected changes after September 16, 2026
  • Monitor network egress from CI/CD environments for connections to t.m-kosche[.]com and implement allowlist-based egress filtering to prevent credential exfiltration (T1041)
  • Establish supply chain security policies requiring dependency review and approval processes before adopting third-party GitHub Actions, and implement automated scanning to detect when pinned dependencies are compromised or repositories are re-enabled after suspension