Executive Summary

Two GitHub Actions repositories—actions-cool/issues-helper and actions-cool/maintain-one-comment—were disabled again after being re‑enabled last week. The repos were compromised during the May 2026 Mini Shai-Hulud malware campaign. The reactivation has prompted a second disabling, indicating ongoing threat activity. The incident highlights the persistence of malicious actors exploiting CI/CD pipelines.

---

Intelligence Metadata - Source Publisher: The Hacker News - Published Date: 2026-09-25T14:44:41+00:00 - Category: threat-intel

Original Description: Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this

"Learn wisdom from the ways of a seedling. A seedling which is never hardened off through stressful situations will never become a strong productive plant."

— Stephen Sigmund