GitHub Actions Repositories Disabled Again After Mini Shai-Hulud Malware Re-emergence

In September 2026, two GitHub Actions repositories linked to the actions-cool organization were disabled for a second time after becoming accessible once more following the May 2026 Mini Shai-Hulud campaign. The affected repositories are actions-cool/issues-helper and actions-cool/maintain-one-comment. According to reports, visiting either repository now displays a message indicating restricted access. This re-disabling follows a brief period last week where the repositories were reachable, raising concerns about persistent threat actor presence or re-infection. The original compromise during the Mini Shai-Hulud campaign involved the injection of malware designed to execute on systems running these GitHub Actions, posing a risk to CI/CD pipelines and the broader software supply chain. GitHub has not released a code patch, as the repositories have been taken offline. Affected users are advised to ensure they are not referencing these actions in their workflows and to monitor for indicators of compromise.