GITHUB ACTIONS RE-ENABLED WITH ACTIVE MALWARE

The third-party GitHub Actions, which had been previously infected during the Mini Shai-Hulud attack, were re-enabled without removing the malicious payload. The actions continued pointing to compromised code for more than seven days after being restored to service. GitHub Actions are automation workflows widely used by developers for continuous integration and deployment. Threat actors exploited this trust by injecting malware into popular community actions, allowing them to compromise downstream projects using these tools. The incident highlights the risks associated with third-party dependencies in development pipelines. Maintainers and users of public actions should verify integrity before and after any updates. GitHub has not yet detailed remediation steps or confirmed whether additional actions remain affected. Organizations relying on third-party GitHub Actions should audit their workflows and review recent execution logs for suspicious activity.