Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. Users who re-added these actions to their workflows were exposed to execution of malicious code, including potential cryptocurrency mining malware and credential theft, compromising CI/CD security and potentially exposing source code and artifacts.

What should defenders do?

GitHub Actions users should verify the integrity of third-party actions, check for recent commits or changes, and avoid re-adding actions until maintainers confirm removal of malicious code. GitHub may need to enforce stricter vetting or signing of third-party actions to prevent future supply chain compromises.

highCyber Attacks

Re-enabled GitHub Actions Still Point to Malicious Mini Shai-Hulud Payload

Third-party actions compromised weeks ago remain active in GitHub Marketplace, exposing users to cryptocurrency miner and credential theft

CyberIntel DeskPublished 3 days agoUpdated less than a minute ago1 min read

Re-enabled GitHub Actions Still Point to Malicious Mini Shai-Hulud Payload

Key Takeaways

Two third-party GitHub Actions re-enabled by their maintainer still contained malicious code from a Mini Shai-Hulud campaign.
The compromised actions remained accessible in the GitHub Marketplace for more than a week after re-enablement.
Users who re-added these actions to their workflows were exposed to potential cryptocurrency mining malware and credential theft.

Related Security News

highCyber Attacks

Former US Air Force Members Sentenced to Prison for Business Email Compromise Scams

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.

BleepingComputerabout 5 hours ago1 min read