Mini Shai-Hulud worm keeps infecting GitHub repos via hijacked actions-cool/issues-helper tags months after the May 2026 compromise

Linha do tempo

1. safedep.io ↗ · pub. 23/09/2026 21:00 · coletado 19/10 18:03 primeiro registro

   Mini Shai-Hulud worm keeps infecting GitHub repos via hijacked actions-cool/issues-helper tags months after the May 2026 compromise

   ler a análise desta fonte ocultar

   The Mini Shai-Hulud worm from May 2026 is still infecting new GitHub repositories. SafeDep found six repositories that received malicious hook files between 20 and 24 September 2026. The cause is that all tags of the actions-cool/issues-helper GitHub Action, hijacked on 18 May 2026, still point to the malicious commit, and the payload is byte-identical to the May build. Any workflow that calls the action by tag runs the payload, which steals CI secrets and then commits Claude Code and VS Code hooks into the repository. A developer who pulls the change and opens the project runs the malware, including the kitty-monitor backdoor, on their own machine.

   Technical Details

   • On 18 May 2026 the attacker moved all 53 tags of actions-cool/issues-helper and all 15 tags of actions-cool/maintain-one-comment to unsigned commits. The commits are titled Build action for <tag>, show the author Jinke Li, and carry timestamps between 19:10 and 19:31 UTC. The tags have not been restored.
   • The malicious composite action.yml installs Bun (oven-sh/setup-bun) and runs index.js (Git blob 2931c1be, 500,143 bytes). It then calls the legitimate action, so the step passes and the bot keeps working.
   • On the runner the payload reads the ghs_ token from Runner.Worker memory and uses it to commit five files through the GraphQL API. These include .claude/index.js, .claude/setup.mjs, .claude/settings.json (a SessionStart hook) and .vscode/tasks.json. setup.mjs downloads Bun 1.3.14 and runs index.js.
   • Commits appear as verified, by github-actions[bot], and the commit message can copy the parent's (for example 3.1.14-7). A second run adds a second hook to the same file.
   • The six affected repositories call the action by tag (@v2.1.1, @v2.2.0, @v2.2.1 or @v3). Each malicious commit landed less than six minutes after the workflow run started. Five of them are issue bots that run daily or on issue events, so reinfection needs no attacker action.
   • The earliest downstream hook commit found is in zhenghefeng251/my_elementPlus, about 80 minutes after the first tag commit. About six hours later the atool npm account compromise published 637 malicious versions using a related build (499,328 bytes). Both builds share the domain t.m-kosche[.]com, Bun 1.3.14, the kitty-monitor backdoor and the hook files.
   • Static decryption of the September sample shows it runs passwordless sudo on the runner and adds 127.0.0.1 entries for the stepsecurity.io domains to /etc/hosts, which can block that runner monitor.
   • The wiper (rm -rf ~/; rm -rf ~/Documents) runs if the stolen GitHub token returns HTTP 40x, if @cap-js/[email protected] receives a deprecation message, or if the npm registry request fails. A token monitor script is installed at ~/.local/bin/gh-token-monitor.sh.
   • The list of six repositories came from GitHub code search, so other infected repositories may exist.

   Remediation

   The article gives no explicit remediation steps. Defenders should search for workflows that reference actions-cool/issues-helper or actions-cool/maintain-one-comment by tag. They should also look for unexpected .claude/ and .vscode/tasks.json files, and for commits by github-actions[bot] that touch them. Secrets exposed to affected workflows should be treated as compromised.