‼️ Mini Shai-Hulud came back without a new attacker update.
Two compromised GitHub Actions became reachable again while their tags still pointed to malicious commits, letting downstream workflows resume executing the credential stealer.
🔗 Here's how the attack reactivated: