GitHub Actions repositories actions-cool/issues-helper and actions-cool/maintain-one-comment, disabled in May after being compromised in the Mini Shai-Hulud supply-chain attack, were reinstated by their maintainer starting September 16 without removing the malicious code. Socket researchers found the release tags still pointed to the original tainted commit, meaning any workflow referencing those version tags resumed downloading and executing the malware payload through at least September 25.
bleepingcomputer.com
· 2026-09-26
French security firm CrowdSec disclosed that attackers used the Shai-Hulud worm to compromise a former employee's machine in May, stealing a GitHub OAuth token that still had read access to the company's private repositories. Over roughly nine minutes, attackers downloaded about 170 private repos plus 130+ public ones; CrowdSec only learned of the breach on September 16 after stolen source code surfaced on the cybercrime marketplace pwnforum.
darkreading.com
· 2026-09-22
The Australian Federal Police announced the arrest of two men from Western Australia on 14 charges related to alleged membership in TeamPCP, a hacking collective linked to widespread supply chain attacks. Authorities say the group's malware, known as Shai-Hulud, spread through compromised open source packages and infected more than 1,000 organizations globally by exploiting CI/CD development pipelines.
arstechnica.com
· 2026-08-28
GoKawiil