CERT24GitHub Actions re-enabled while the Mini Shai-Hulud payload remained activeLoading data…
CERT24Threat Observatory
Period

GitHub Actions re-enabled while the Mini Shai-Hulud payload remained active

Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled on September 16, but their release tags still pointed to a commit containing malicious code. Both Actions were disabled again on September 25.

← Back to intelligence

GitHub Actions re-enabled while the Mini Shai-Hulud payload remained active

Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled on September 16, but their release tags still pointed to a commit containing malicious code. Both Actions were disabled again on September 25.