Mini Shai-Hulud in ant-design/pro-components:
a bug report woke a hijacked Action, six branches fell in seven seconds, and four kept the worm for three weeks

Who reported this first

Aikido opened issue #9704, "This repository is compromised", at 06:53 UTC on 24 September, three hours after the commit. SafeDep's write-up the same day named commit 1bc4049d on the default branch among six reinfected repositories. Socket documented how GitHub re-enabled actions-cool/issues-helper on 16 September with its May tags still pointing at malicious commits. The payload family was described in May by Corgea and others during the AntV wave.

Our commit monitoring watches this repository and raised nothing on the worm's commit. We explain why near the end, and what we changed.

We reported the four infected branches and the unchanged workflow to the Ant Design team on 14 October 2026. The address in their security policy bounced, and private reporting was switched off on pro-components, so we used a private security advisory on the main ant-design repository and opened issue #9760 to point the maintainers to it.

The maintainers confirmed the report and fixed it within five hours. By 02:08 UTC on 15 October they had removed the five files from all four branches, replaced both issue workflows with versions that use no third-party actions and ask only for issues: write, removed the workflows that used the also-compromised actions-cool/maintain-one-comment, turned on private vulnerability reporting, and extended the repository's safety check to reject .claude/settings.json. We re-checked all 17 branches: none still carries the files. Thank you to the Ant Design team for the fast, thorough fix.

What the run logs add

GitHub keeps Actions logs for 90 days, so the run that made the commits can still be read. Together with the repository's activity log and commit signatures, it fills in the parts of the story that were missing.

How a bug report pushed malware to six branches

Who could have picked it up

The npm package was not affected. Version 3.1.14-7 was published on 28 August, before the commit, and the next release, 3.1.15-1 on 26 September, was built after the revert; neither contains the files, and no 3.1.15 release declares an install script. The exposure is anyone who checked out an infected branch and opened it in Claude Code or VS Code.

One pull request was merged on top of the infected master through the web interface before the revert, which needs no local copy. The maintainer who wrote the revert did it locally, and the contributor behind PR #9702 merged the infected main into their branch, so at least two people had the files on disk. We cannot see clones, and we cannot tell whether any editor ran the hooks. The maintainers also added a repository safety check and a security policy on 25 September, which now rejects these files in CI.

What gave it away, and what did not

The commit landed at 03:43 UTC on a Thursday, late morning for maintainers in UTC+8. Timing gave nothing away (fig. 5). The author did: in more than seven thousand commits since 2017, github-actions[bot] had never authored a commit on master before (fig. 4). A bot account that never commits, adding executable editor configuration with a recycled message, is a strong signal on its own terms.

What the payload is

We decoded .claude/index.js statically, without running it. It is the build used in the May 2026 AntV and SAP wave attributed to TeamPCP (MITRE S9043). It shares the exfiltration endpoint and repository markers Corgea published in May, and the gh-token-monitor component SafeDep described.

• It carries the commit. The script holds encrypted copies of setup.mjs, settings.json and tasks.json that are byte-identical to the committed files, and commits them, plus itself, to up to 50 branches with the job token. That is the burst in fig. 1.
• It steals credentials from files, environment variables, the CI runner's memory, cloud secret stores, Kubernetes, Vault and local password managers, and sends them to a C2 disguised as OpenTelemetry traffic, with public GitHub repositories as a fallback.
• It defends itself. gh-token-monitor polls GitHub every minute and runs rm -rf ~/ if the stolen token stops working. In this build it arms when the token's owner belongs to no GitHub organisation.
• It is not perfect. In our reading, setup.mjs only runs the payload on machines that do not already have Bun installed.

Why our commit monitoring missed it

We watch this repository's commits. Our rules looked for install scripts, build configuration and workflow changes. They had no rule for .claude/ or .vscode/ files, and they treated Markdown as documentation. So the worm's commit, which touched nothing else, produced no alert. The next day we did alert, on the maintainers' own clean-up commit, because it added a pre-publish check. Rules for agent autorun hooks, VS Code folder-open tasks and agent instruction files are now in review, tested against this commit and the earlier keyv one. We also did not watch GitHub Action tags, which is how this one got in.

Indicators of compromise

Check a clone and a machine

Find the same entry point in your own workflows

The worm did not need a stolen password. It needed three things: a workflow anyone could start by opening an issue, a third-party action pinned to a tag, and a token with write access. Our CLI checks for that shape locally. The CI checks are built in, so there is no engine to install and no account needed.

Run against the two issue workflows on the pro-components master branch on 14 October, it reports seven findings, two of them high:

To turn it into a gate, add xyz code-scan ci . --fail-on high to your pipeline. It exits non-zero on any high finding. Add --format sarif -o xyz-ci.sarif to send the results to GitHub code scanning. Today the CLI flags the tag pin and the missing permissions, but it does not yet know that this particular action was hijacked. Two new rules are in review: one names known-compromised actions, and one flags agent and editor autorun files like the five above.

What to change

• Pin every third-party action to a full commit SHA, and replace actions whose repositories were compromised. A tag is a pointer anyone with write access can move.
• Declare permissions: on every workflow. An issue-labelling job needs issues: write, not write access to contents, actions and pages.
• Protect or delete long-lived branches. The four branches the clean-up missed had not been touched in months or years. Nobody was looking at them.
• Treat editor and agent configuration in a repository as code. Review .claude/, .vscode/tasks.json and similar files in pull requests, set task.allowAutomaticTasks to off in VS Code, and read a repository's Claude Code hooks before you trust it.
• Act on the flag. An AI reviewer marked these files for removal and a security researcher filed an issue within hours. Both signals were there; what was missing was someone assigned to them.

MITRE ATT&CK