GitHub re-enables third-party actions despite active malicious code

A maintainer re-enabled two GitHub actions compromised by the Mini Shai-Hulud campaign.

Published 6sem1 sourceNotable

≈ 17sSpeed

The fact

The repositories still pointed to malicious code over a week after being re-enabled.

GitHub has not yet commented on this persistent security flaw.

Click the link to read an article on the topic:

Explore this topic

Auto-synthesis from 1 media source · identified on September 26, 2026