Compromised GitHub Actions Reactivated and Resumed Executing Mini Shai-Hulud Malware
Headline by Prism · from 1 report
Compromised GitHub Actions from the Mini Shai-Hulud campaign were briefly reactivated, causing automated workflows to resume executing malicious code.
The Hacker NewsThe brief
Written by software from the 1 report below.
- Two GitHub Actions previously linked to the Mini Shai-Hulud malware campaign were unexpectedly made accessible again on September 16, 2026.
- Because these actions used mutable release tags that still pointed to malicious content, workflows referencing them automatically downloaded and executed the payload.
- The incident demonstrates the risks of using mutable tags in CI/CD pipelines instead of pinning specific commit SHAs.
- Security researchers advise developers to audit their repositories, remove the affected actions, and rotate any potentially exposed credentials.
What to watch next
- Determination of why the repository access was restored by GitHub.
- Identification of additional repositories potentially impacted by the reactivation.
The points restate the reports; where one says why it matters, that is Prism's reading, not a reported fact.
Who said what
Only words found exactly in the article are shown, attributed and linked to the line they came from.
Philipp Burckhardt
head of threat intelligence at Socket
1 quote · 1 outlet
“That points to the same Mini Shai-Hulud activity cluster, not a separate npm-only incident”
In the article
…was subsequently linked to the Mini Shai-Hulud activity cluster, citing overlaps in the exfiltration domain ("t.m-kosche[.]com") used in the GitHub Actions workflows and the npm packages from the @antv ecosystem. " That points to the same Mini Shai-Hulud activity cluster, not a separate npm-only incident ," Philipp Burckhardt, head of threat intelligence at Socket, told The Hacker News at the time. The repositories were re-enabled on September 16, 2026, at some point between 11:09 a.m. and 6:16 p.m. GMT+2. It's…
Coverage
1 outlet
All filed from India
NamedUnited States · GitHub · Karlo Zanki · Mini Shai-Hulud · Philipp Burckhardt · Socket
The 1 report is listed beside the record.
Corrections and versions
A correction says what was wrong and why. Every earlier headline and brief of this record is kept.
Something wrong?
Say what, and it arrives with this record's address filled in. A correction is welcome.
Ask this story
Answers cite the 1 report above, or say they can't.