Two third-party GitHub Actions, previously compromised in the Mini Shai-Hulud campaign, were re-enabled by their maintainer and remained accessible for over a week while still pointing to malicious code. This allowed the continued execution of the Mini Shai-Hulud malware, posing a supply chain risk to projects using these actions. The incident highlights the challenges in ensuring the integrity of open-source components and the need for rigorous verification.