{"slug": "mini-shai-hulud-is-still-infecting-github-repositories", "title": "Mini Shai-Hulud Is Still Infecting GitHub Repositories", "summary": "The Mini Shai-Hulud worm infected six new GitHub repositories between 20 and 24 September 2026, four months after attackers hijacked all 53 tags of the actions-cool/issues-helper GitHub Action on 18 May 2026, according to a report on the ongoing campaign. The payload, byte-identical to the May build with Git blob 2931c1be (500,143 bytes), steals CI secrets via the ghs_ token read from Runner.Worker memory and commits Claude Code and VS Code hook files, including .claude/setup.mjs which downloads Bun 1.3.14, to repositories such as jd-opensource/micro-app (6,254 stars) and MaaXYZ/MaaFramework (4,914 stars). The tags still point to the malicious commit, so any workflow calling the action by tag (@v2.1.1, @v2.2.0, @v2.2.1, or @v3) continues to run the payload, and all six default branches still contain the hook files.", "body_md": "# Mini Shai-Hulud Is Still Infecting GitHub Repositories\n\nOn this page\n\nThe May 2026 Mini Shai-Hulud worm is still infecting new GitHub repositories. The payload is byte-identical to the May build.\n\nThe worm spreads through the `actions-cool/issues-helper` GitHub Action. Attackers hijacked its\ntags in May. Four months later, the tags still point to the malicious commit.\n\nAny workflow that calls the action by tag still runs the payload. The payload steals the CI secrets. Then it commits Claude Code and VS Code hooks into the repository. A developer who pulls the change and opens the project runs the malware on their own machine.\n\n## Newly infected repositories\n\nSix repositories received the hook files between 20 and 24 September.\n\n| Repository | Stars | Infection commit, UTC | Probable trigger | \n|---|---|---|---|\n| [jd-opensource/micro-app](https://github.com/jd-opensource/micro-app) | 6,254 | [`c610739c`](https://github.com/jd-opensource/micro-app/commit/c610739cc5d2493704509ae7f755d4f79229c68b) , 09-21 03:43 | `Close Inactive Issue` | \n| [MaaXYZ/MaaFramework](https://github.com/MaaXYZ/MaaFramework) | 4,914 | [`97123f91`](https://github.com/MaaXYZ/MaaFramework/commit/97123f9160fcf03964187e66abcc2824f8fa1d9a) , 09-24 07:03 | `Release` | \n| [ant-design/pro-components](https://github.com/ant-design/pro-components) | 4,833 | [`1bc4049d`](https://github.com/ant-design/pro-components/commit/1bc4049d295a4af4da3cef8074e4b5d7312a6858) , 09-24 03:43 | `Issue Open Check` | \n| [Moonofweisheng/wot-design-uni](https://github.com/Moonofweisheng/wot-design-uni) | 2,300 | [`0320fd8a`](https://github.com/Moonofweisheng/wot-design-uni/commit/0320fd8a3825502362d91c1e46c061290c156197) , 09-20 16:16 | `Issue Inactive` | \n| [vbenjs/vben-admin-thin-next](https://github.com/vbenjs/vben-admin-thin-next) | 2,072 | [`d83cd757`](https://github.com/vbenjs/vben-admin-thin-next/commit/d83cd757e7731d9e62882758646e25614519e142) , 09-24 04:21 | `Issue Close Require` | \n| [nineaiyu/xadmin-client](https://github.com/nineaiyu/xadmin-client) | 139 | [`257a90c8`](https://github.com/nineaiyu/xadmin-client/commit/257a90c876fb858a54bbdeb47836701aefa0dabc) , 09-22 04:38 | `Issue Close Require` | \n\nEach trigger workflow calls `actions-cool/issues-helper` by tag (`@v2.1.1`, `@v2.2.0`, `@v2.2.1`,\nor `@v3`). Each malicious commit came less than six minutes after the workflow run started. The\ntrigger is an inference from this timing.\n\nFive triggers are issue bots. They run each day or on an issue event, so the infection repeats without the attacker.\n\nAll six default branches still contain the hook files. GitHub code search produced this list, so it can miss other repositories.\n\n## How the infection spreads\n\nOn 18 May 2026, the attacker moved all 53 tags of `actions-cool/issues-helper`. The attacker also\nmoved all 15 tags of `actions-cool/maintain-one-comment`. The new commits have timestamps from\n19:10 to 19:31 UTC.\n\nEach new commit has the message `Build action for <tag>` and the author `Jinke Li`. The commits\nare not signed. Nobody has restored the tags.\n\nThe malicious `action.yml` runs the payload first. Then it calls the real action, so the step\npasses and the bot works as usual.\n\nThe action’s `index.js` has Git blob `2931c1be` (500,143 bytes). Each of the six repositories has\nthe same file at `.claude/index.js`.\n\n## What the payload commits\n\nOn a runner, the payload reads the `ghs_` token from `Runner.Worker` memory. It uses the token to\ncommit five files to the repository.\n\n`.vscode/tasks.json` runs the same command when VS Code opens the folder. `.claude/setup.mjs`\ndownloads Bun 1.3.14 and runs `.claude/index.js`.\n\nThe `kitty-monitor` backdoor installer skips CI runners. On a developer’s machine, the payload\ninstalls that backdoor. It can also install the token monitor and its wiper.\n\nThe commits are easy to miss in a review:\n\n- GitHub shows them as verified, by `github-actions[bot]` . The payload commits through the GraphQL\nAPI with the repository’s own token.\n- The message can copy the previous commit. The `pro-components` commit and its parent both say`3.1.14-7` .\n- A second run adds a second hook to the same file. `micro-app` received two commits two minutes\napart ([`c096c93f`](https://github.com/jd-opensource/micro-app/commit/c096c93f08f3472b5a0d0e808a9265ecb49b683c) ).\n\n## Relation to the May campaign\n\nThe September infections come from the May 2026 Mini Shai-Hulud wave. For these six repositories,\nit is the first infection found. The September commits are the first to touch `.claude/setup.mjs`\non their default branches.\n\nThe earliest downstream hook commit found is in `zhenghefeng251/my_elementPlus`. It has blob\n`2931c1be` and a time of 18 May, 20:31 UTC, about 80 minutes after the first tag commit.\n\nAbout six hours later, the [`atool` npm account compromise](https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised)\npublished 637 malicious versions. That wave used a related build (499,328 bytes). Both builds\nuse `t.m-kosche[.]com`, Bun 1.3.14, the `kitty-monitor` backdoor, and the same hook files.\n\nA static decryption of the September sample adds two facts to the May post:\n\n- The payload runs `sudo` without a password on the runner. It adds`127.0.0.1` entries for the`stepsecurity.io` domains to`/etc/hosts` . This can block that runner monitor.\n- The wiper (`rm -rf ~/; rm -rf ~/Documents` ) runs if the stolen GitHub token returns HTTP 40x. It\nalso runs if`@cap-js/`[\\[email protected\\]](https://safedep.io/cdn-cgi/l/email-protection)\ngets a deprecation message, or if the npm registry request\nfails.\n\n## Indicators of compromise\n\n| Type | Value | \n|---|---|\n| Hijacked actions | `actions-cool/issues-helper` (53 tags),`actions-cool/maintain-one-comment` (15 tags) | \n| Malicious tag commit, v3 | `147337a919d9` | \n| Payload Git blob | `2931c1be43b0d04174636ddbff54963aec92bdeb` , 500,143 bytes | \n| `setup.mjs` Git blob | `0bbd3d17062ded7c8159ffe22d0a4f3a85e4823e` , 5,346 bytes | \n| Exfiltration host | `t.m-kosche[.]com/api/public/otel/v1/traces` | \n| Commit search markers | `firedalazer` ,`thebeautifulmarchoftime` | \n| Persistence | `kitty-monitor` ,`gh-token-monitor` ,`~/.local/share/kitty/cat.py` | \n| Wiper trigger package | `@cap-js/`[\\[email protected\\]](https://safedep.io/cdn-cgi/l/email-protection) | \n\n- malware\n- github-actions\n- supply-chain\n- config-files\n\n### Author\n\n#### SafeDep Team\n\nsafedep.io\n\n### Share\n\n## The Latest from SafeDep blogs\n\nFollow for the latest updates and insights on open source security & engineering\n\n   \n\n##   [ASOS App Hack: Attackers Used Push Notifications to Send a Ransom Note](https://safedep.io/asos-push-notification-extortion-snowflake-claim)  \n\n Attackers got into the platforms ASOS uses to message customers and pushed an extortion note to phones. Here is what is confirmed, what is only claimed, and what customers should do.\n\n   \n\n##   [42 Malicious RubyGems Open a Reverse Shell at Install Time](https://safedep.io/rubygems-crypto-gems-install-time-reverse-shell)  \n\n One RubyGems account published 42 gems that run code during gem install. On a developer workstation, the gems open a reverse shell or download a second stage. They do nothing on CI runners and...\n\n   \n\n##   [tensorlake 0.5.144 npm Compromise Ships Mini Shai-Hulud](https://safedep.io/tensorlake-npm-compromise-mini-shai-hulud)  \n\n  [\\[email protected\\]](https://safedep.io/cdn-cgi/l/email-protection) on npm ran a Mini Shai-Hulud worm at install. A maintainer account committed the payload through the GitHub web interface, and the official release workflow published it. \n\n   \n\n##   [An Attacker Hijacked an AI Coding Assistant to Spread a Worm](https://safedep.io/ai-coding-assistant-hijack-shai-hulud)  \n\n An attacker took over a live AI coding assistant session, got it to recommend a poisoned package, and used the stolen tokens to spread the Shai-Hulud worm across about 100 internal repositories.\n\n## Ship Code.\n\n## Not Malware.\n\nStart free with open source tools on your machine. Scale to a unified platform for your organization.", "url": "https://wpnews.pro/news/mini-shai-hulud-is-still-infecting-github-repositories", "canonical_source": "https://safedep.io/mini-shai-hulud-reinfection-github-repositories", "published_at": "2026-09-24 00:00:00+00:00", "updated_at": "2026-10-09 14:22:24.538407+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-agents", "developer-tools"], "entities": ["Mini Shai-Hulud", "GitHub", "actions-cool/issues-helper", "actions-cool/maintain-one-comment", "jd-opensource/micro-app", "MaaXYZ/MaaFramework", "ant-design/pro-components", "Claude Code"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/mini-shai-hulud-is-still-infecting-github-repositories", "markdown": "https://wpnews.pro/news/mini-shai-hulud-is-still-infecting-github-repositories.md", "text": "https://wpnews.pro/news/mini-shai-hulud-is-still-infecting-github-repositories.txt", "jsonld": "https://wpnews.pro/news/mini-shai-hulud-is-still-infecting-github-repositories.jsonld"}}