Remove them or pin a clean commit SHA from before May 18, rotate the secrets those workflows could reach since September 16, and pin every third-party action to a full commit SHA.
actions-cool/issues-helper and actions-cool/maintain-one-comment, disabled in May after the Mini Shai-Hulud compromise, became available again on September 16 with their malicious tags still in place. Socket counts about 15,000 repositories depending on issues-helper alone.
Its advice: remove them or pin a clean commit SHA from before May 18, rotate the secrets those workflows could reach since September 16, and look for runs that suddenly took minutes instead of seconds.
