simonecorsi/mawesome GitHub Action has been compromised

On June 24, 2026, an attacker compromised the simonecorsi/mawesome GitHub repository. They force-pushed malicious commits and repointed several version tags to that commit. As a result, any workflow running against those tags after that time executed the attacker's code inside its GitHub Actions runner.

Varun Sharma

June 24, 2026

On June 24, 2026, an attacker compromised the simonecorsi/mawesome GitHub repository. They force-pushed malicious commits and repointed several version tags to that commit. As a result, any workflow running against those tags after that time executed the attacker's code inside its GitHub Actions runner.

The attack method is very similar to the codfish/semantic-release-action GitHub Actions compromise from earlier today.

Affected Tags

Tag	Current Commit
`latest`	e339407b8e34
`v1`	e339407b8e34
`v2`	e339407b8e34
`v2.2.0`	e339407b8e34
`v2.1.0`	6e26314c306e
`v2.0.0`	7a59a7d02b1f

‍

This is a developing story.

Acknowledgement

Thanks to Sean Smith for sharing information about this compromise.

Blog

Explore Related Posts

‍

jscrambler npm package publishes malicious preinstall binary

On July 11, 2026, version 8.14.0 of jscrambler was published to npm carrying a malicious preinstall hook that drops and executes a platform-specific native binary on Linux, Windows, and macOS. jscrambler is the official CLI client for the Jscrambler Code Integrity API, a commercial JavaScript obfuscation and web-app protection service, with a clean version history dating back to 0.1.0. The compromised release was flagged by StepSecurity's AI Release Analyzer with a suspicion score of 0 (the maximum suspicion rating) on publish.

Rohan Prabhu

July 11, 2026

Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys

On July 8, 2026, attackers used access to a trusted developer's account to slip a backdoor into a widely used software development kit for the Injective blockchain. Disguised as harmless analytics, the code quietly captured wallet recovery phrases and private keys and sent them to an attacker-controlled server the moment a wallet was created or loaded. Automatic publishing pushed the tainted code out to 18 related packages within minutes, and it stayed live for less than an hour before being pulled and fixed. If your application installed any of the affected packages during that window, or picked up a cached copy since, treat any wallet secrets it touched as exposed.

Sai Likhith

July 9, 2026

Introducing Secret Exfiltration Protection for GitHub Actions

StepSecurity now blocks and detects secret exfiltration in GitHub Actions, stopping attacks that plant malicious workflows to steal your repository secrets.

Varun Sharma

July 7, 2026