Post

Socket
@socket.dev

🚨 Two GitHub Actions compromised in May’s Mini Shai-Hulud campaign are running malware again. The repositories were re-enabled with malicious release tags intact, putting thousands of downstream repositories at risk. socket.dev/blog/mini-sh...

socket.devRe-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-HuludTwo compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

3 reposts7 likes

Socket
@socket.dev

Bottom line: You can’t control when a compromised repository comes back online, but you can control what your workflows run. Pin third-party GitHub Actions to a known-clean commit SHA. That would have stopped this malicious code from running in both May and September.