x.comthreadJulio Bandeira de Melo (@juliobmelo) on X
Two GitHub Actions from the actions-cool maintainer, disabled by GitHub security after May's supply-chain compromise, were reactivated by the maintainer and left accessible for over a week without the malicious release tags being cleaned up. Any workflow still referencing those version tags resumed automatically downloading and executing the Mini Shai-Hulud payload, showing that disabling a compromised action isn't remediation if the poisoned tags survive reactivation.
TL;DR Re-enabled actions-cool GitHub Actions kept serving the Mini Shai-Hulud payload for a week because their malicious release tags were never cleaned up.
Organisations named here
- actions-cool
Technologies named here
- actions-cool GitHub Actions repositories
- GitHub security - disabled the compromised actions
- GitHub Actions
Threat actors named here
- Mini Shai-Hulud payload
- Mini Shai-Hulud
Related in Supply Chain
