Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
GitHub disabled two actions-cool Actions again after re-enabled repositories left malicious May 18 tags able to execute credential-stealing code.
More info