Severity: HIGH · Priority: P2 — CI/CD credential theft from active build pipelines, investigate on hit
Rule note — GS TROJAN: Mini Shai-Hulud CI/CD credential exfiltration domain m-kosche.com
These rules detect a connection to the exfiltration domain used by Mini Shai-Hulud, a supply-chain attack campaign attributed to the TeamPCP threat actor, which compromises GitHub Actions workflows and npm packages to steal credentials from CI/CD pipelines. The campaign first struck in May 2026, compromising the actions-cool/issues-helper and actions-cool/maintain-one-comment GitHub Actions workflows by redirecting all version tags to malicious commits. Any CI/CD pipeline that referenced those actions by version tag silently ran malicious code on its next build. The malicious code reads the GitHub Actions runner's process memory to extract secrets, harvests credentials from cloud providers, npm, Kubernetes, and AI tools, and exfiltrates everything — encrypted and disguised as OpenTelemetry observability traces — to an attacker-controlled server. The campaign is a worm: stolen tokens are used to publish infected versions of other packages under the same maintainer's control, spreading the infection further.
The September 2026 relevance: the originally compromised repositories were suspended after discovery but were re-enabled on September 16, 2026, with the malicious code still in place and never removed. Any workflow that references the affected actions by version tag (rather than a pinned commit SHA) ran the malicious payload again on the first build after that date. Workflows pinned to a full commit SHA predating May 18, 2026 are not affected.
A hit indicates a machine on your network — most likely a CI/CD runner or a developer's workstation — is sending data to the attacker's collection server. Treat it as an active credential-theft event: identify the source machine and check for recent workflow runs that referenced actions-cool/issues-helper@v2.2.1 or actions-cool/maintain-one-comment, or any build that installed compromised npm packages from the @antv ecosystem between May and September 2026. Rotate all credentials accessible from that build environment: GitHub personal access tokens, npm publish tokens, AWS keys, SSH keys, and any secrets stored in CI environment variables. Check for unauthorized public repositories created under GitHub accounts whose tokens were accessible, for new .github/workflows/codeql.yml files with a workflow named "Run Copilot," and for files named cloud.json, contents.json, or environment.json in the home directory. Also review Sigstore transparency log entries for any signed artifacts created by compromised CI identities.
Two limits worth knowing. These rules detect the exfiltration call to the attacker's server; they do not detect the earlier step where the malicious workflow or package runs and harvests the credentials. A build that ran the malicious code but has not yet exfiltrated would not trigger these rules. And because the traffic is disguised as OpenTelemetry telemetry, it is likely to blend with legitimate observability traffic from development environments; the DNS rule is the most reliable catch since it fires before the encrypted connection is established. All rules are alert-only; they do not block traffic.
References: Socket.dev — Mini Shai-Hulud CI/CD Actions (socket.dev/blog/mini-shai-hulud-actions); The Hacker News — Compromised GitHub Actions came back online and resumed executing Mini Shai-Hulud malware (Sep 2026); SafeDep — Mini Shai-Hulud strikes again; Microsoft Security Blog — Mini Shai-Hulud compromised @antv npm packages (May 2026).

Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this

Source: Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware via The Hacker News — published 25 Sep 2026.