Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

Two compromised GitHub Actions, issues-helper and maintain-one-comment, were temporarily accessible again after being disabled months prior due to the Mini Shai-Hulud campaign in May 2026. These actions have now been disabled for a second time. The repositories for these actions are currently inaccessible, displaying an access restriction message. The actions were part of the actions-cool GitHub organization. They were compromised as part of the Mini Shai-Hulud malware campaign. The repositories were taken offline again after regaining accessibility last week.