Compromised GitHub Actions resumed distributing Mini Shai-Hulud malware

Two GitHub Actions repositories—actions-cool/issues-helper and actions-cool/maintain-one-comment—became accessible again on September 16, 2026, while their release tags still pointed to malicious content introduced on May 18, 2026. Workflows referencing either action by a version tag consequently resumed downloading and executing the payload on their next run.