âŧī¸ Mini Shai-Hulud came back without a new attacker update.
Two compromised GitHub Actions became reachable again while their tags still pointed to malicious commits, letting downstream workflows resume executing the credential stealer.
đ Here's how the attack reactivated: