GitHub Actions Re-Enabled With Malware Payload

Two GitHub Actions compromised in May's Mini Shai-Hulud campaign were re-enabled by their maintainer from September 16 to 25, still pointing to malicious code. Workflows referencing the actions by version tag downloaded and executed the payload. GitHub disabled them again on September 25. About 15,000 repositories depend on issues-helper, though not all were compromised.