simonecorsi/mawesome GitHub Action has been compromised - StepSecurity
2026-06-25
·
via Step Security Blog
On June 24, 2026, an attacker compromised the simonecorsi/mawesome GitHub repository. They force-pushed malicious commits and repointed several version tags to that commit. As a result, any workflow running against those tags after that time executed the attacker's code inside its GitHub Actions runner.
The attack method is very similar to the codfish/semantic-release-action GitHub Actions compromise from earlier today.
Affected Tags
| Tag |
Current Commit |
latest |
e339407b8e34 |
v1 |
e339407b8e34 |
v2 |
e339407b8e34 |
v2.2.0 |
e339407b8e34 |
v2.1.0 |
6e26314c306e |
v2.0.0 |
7a59a7d02b1f |
This is a developing story.
Acknowledgement
Thanks to Sean Smith for sharing information about this compromise.
Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised
On June 24, 2026, an attacker published malicious versions of 20 npm packages belonging to the Leo Platform ecosystem in a coordinated burst spanning less than three seconds. All 20 packages carry an identical CI/CD attack toolkit that steals secrets from GitHub Actions runners, cloud credential stores, package registries, and password managers, then exfiltrates them via the victim's own GitHub token. Together these packages receive approximately 13,600 downloads per week.
On June 24, 2026, an attacker compromised the simonecorsi/mawesome GitHub repository. They force-pushed malicious commits and repointed several version tags to that commit. As a result, any workflow running against those tags after that time executed the attacker's code inside its GitHub Actions runner.
codfish/semantic-release-action GitHub Action has been compromised
On June 24, 2026, an attacker compromised the codfish/semantic-release-action GitHub repository. At 15:39:06 UTC they force-pushed a malicious commit and repointed several version tags to that commit. As a result, any workflow running against those tags after that time executed the attacker's code inside its GitHub Actions runner.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
