simonecorsi/mawesome GitHub Action has been compromised

On June 24, 2026, an attacker compromised the simonecorsi/mawesome GitHub repository. They force-pushed malicious commits and repointed several version tags to that commit. As a result, any workflow running against those tags after that time executed the attacker's code inside its GitHub Actions runner.

The attack method is very similar to the codfish/semantic-release-action GitHub Actions compromise from earlier today.

This is a developing story.

Acknowledgement

Thanks to Sean Smith for sharing information about this compromise.