Skip to content

Back to the catalog

Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets
aikido.devwriteup

Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets

Aikido Security details how codfish/semantic-release-action, a widely used GitHub Action for automated releases since 2019, was compromised via an imposter-commit attack: an attacker force-pushed two orphan commits (disguised with reused real commit metadata) and retargeted sixteen tags including the floating v2–v5 majors to point at them. The malicious action.yml was rewritten as a composite action that still calls the legitimate action first so runs appear successful, then loads Bun via oven-sh/setup-bun and executes a heavily obfuscated 781KB index.js payload targeting GITHUB_TOKEN and NPM_TOKEN secrets. The payload contains the dead-drop marker "thebeautifulsnadsoftime," tying it to the leaked Miasma credential-stealing toolkit, which polls GitHub's public commit search API for that string to fetch and eval() attacker commands instead of using traditional C2 infrastructure.

TL;DR Attacker hijacked floating v2–v5 tags on codfish/semantic-release-action via orphan imposter commits to inject a Miasma-toolkit credential stealer that exfiltrates CI/CD secrets and takes commands via a GitHub-commit-search dead-drop instead of a C2 server.
Open original ↗
Document

What it is

A supply-chain compromise of codfish/semantic-release-action, the de-facto standard GitHub Action for wiring semantic-release into CI since 2019 (100+ stars). On Jun 24, 2026 an attacker force-pushed two orphan commits and repointed sixteen tags — including the floating majors v2, v3, v4, v5 — so any workflow pinned to those tags runs attacker code on its next CI run.

How it works

Git tags are unprotected by default, and Actions resolves a tag to a commit at run time, so retroactively moving a tag silently rewrites every future run with no signal to the workflow author. The malicious action.yml is rewritten from the original Docker action into a composite action whose first step still calls the real action (pinned to clean commit 8f9a58f2acdc190c356f79159b5de2548cdb63cd), so runs look green. Two trailing steps use if: always() to install oven-sh/setup-bun and execute a 781,580-byte obfuscated index.js via bun run. The old Dockerfile/entrypoint.js are left in the tree as diff cover; a composite action ignores them. The payload contains the marker thebeautifulsnadsoftime (one transposed letter from TheBeautifulSandsOfTime), tying it to the leaked Miasma toolkit, which polls GitHub's public commit-search API for that marker and eval()s matching payloads instead of using a C2 — evading egress monitoring.

Preconditions / Affected

Any workflow referencing the action by a hijacked tag. Affected tags: v2 (from the second commit); v2.2.1, v3/v3.0.0–v3.5.0, v4/v4.0.0/v4.0.1, v5/v5.0.0 (from the first). The imposter commit reuses real author identity, date, and message (Merge pull request #195, Nov 9 2023) — so a git log skim won't flag it. At risk: the GITHUB_TOKEN and any NPM_TOKEN with publish access these release workflows typically hold.

What to do

  • Treat any CI run using an affected tag since Jun 24, 2026 as compromised; rotate GITHUB_TOKEN, NPM_TOKEN, and any other secrets exposed to those runs.
  • Grep your action.yml/logs for the tells: a step invoking oven-sh/setup-bun and:
bun run $GITHUB_ACTION_PATH/index.js
  • Pin third-party actions to a full 40-char commit SHA you have verified, not to floating tags.
  • Aikido users: filter the central feed on malware issues (surfaces as a 100/100 critical) and trigger a manual rescan; nightly rescan otherwise.

Caveats

Both commits ship a byte-identical index.js (hash-confirmed). The Miasma link rests on the marker string, which the page notes also appears in @redhat-cloud-services npm packages and other repos from the same leak — expect further spread now that the toolkit is public.

Organisations named here

  • TheBeautifulSandsOfTime

Technologies named here

  • codfish/semantic-release-action
  • Aikido
  • Aikido Device Protection
  • Aikido Safe Chain
  • oven-sh/setup-bun
  • GitHub Actions
  • Bun
  • npm

Techniques named here

  • Imposter commit attack
  • Git tag hijacking via force-push
  • Commit metadata spoofing
  • Orphan commit grafting
  • Minimal diff cover
  • Composite action wrapping legitimate action
  • Dead drop resolver via public commit search
  • JavaScript obfuscation
  • CI/CD secret theft

Threat actors named here

  • Miasma

Related in Supply Chain