Act
active
Compromised GitHub Actions re-enabled with Mini Shai-Hulud payload intact
- Engineer — Act: Active supply-chain compromise in CI/CD is a direct Act trigger — audit every pipeline that references these affected Actions, check recent build logs for signs of malicious payload execution, and rotate any secrets or tokens exposed to those workflow runs.
- SOC/IR — Plan: No IOCs are published in this item, but the Mini Shai-Hulud campaign name suggests threat-intel feeds may carry indicators — check those feeds and build a detection for anomalous GitHub Actions workflow executions or unexpected secret-access events in your CI/CD telemetry.
- Leader — Plan: A named supply-chain campaign actively re-compromising CI/CD Actions warrants asking your engineering team this quarter to confirm pipeline dependency exposure and report back on whether any credential material was at risk.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.