stepsecurity.ioadvisorysimonecorsi/mawesome GitHub Action has been compromised
StepSecurity reports that the simonecorsi/mawesome GitHub Action repository was compromised on June 24, 2026, when an attacker force-pushed malicious commits and repointed several release tags to point at them, so any workflow pinned to those tags subsequently ran the attacker's code inside its GitHub Actions runner. StepSecurity notes the attack method mirrors the codfish/semantic-release-action compromise disclosed the same day, suggesting a coordinated campaign targeting GitHub Action maintainers via tag hijacking.
TL;DR Attacker force-pushed and re-tagged simonecorsi/mawesome GitHub Action to run malicious code in consumers' CI pipelines, echoing the same-day codfish/semantic-release-action compromise.
Technologies named here
Techniques named here
- Git tag repointing / force-push compromise
Threat actors named here
Related in Supply Chain
