cyber.hendryadrian.com
Cyber Attack & Data Breach · stepsecurity.io

Step Security Reports Compromise of simonecorsi/mawesome GitHub Action

· Original article ↗

Summary

Step Security reports that attackers compromised simonecorsi/mawesome on June 24, 2026, force-pushed malicious commits and repointed version tags; workflows using affected tags then ran the code on GitHub Actions runners.

Key points

  • The article reports that an attacker compromised the simonecorsi/mawesome GitHub repository on June 24, 2026, and force-pushed malicious commits.
  • Several version tags were repointed; the article says workflows running against affected tags executed the attacker's code in GitHub Actions runners.
  • The listed tags were latest, v1, v2, v2.2.0, v2.1.0 and v2.0.0. The first four pointed to e339407b8e34; v2.1.0 and v2.0.0 were listed with different commit hashes.
  • Step Security describes the story as developing.

Article Details

Victim Organization
simonecorsi/mawesome
Incident Type
GitHub Actions supply-chain compromise through malicious commits and repointed version tags
Incident Date
2026-06-24
Operational Impact
Workflows using the affected tags after the compromise executed attacker code inside their GitHub Actions runners.
Claim Status
confirmed

MITRE ATT&CK

T1195.001 · Compromise Software Dependencies and Development ToolsThe attacker compromised a GitHub repository, pushed malicious commits, and repointed version tags, causing workflows that used those tags to execute the attacker's code.

People

Sean SmithAcknowledged for sharing information about the compromise.

Vendors

GitHubOn June 24, 2026, an attacker compromised the simonecorsi/mawesome GitHub repository. They force-pushed malicious commits and repointed several version tags to that commit. As a result, any workflow running against

Products

GitHub Actionsany workflow running against those tags after that time executed the attacker's code inside its GitHub Actions runner.

Related Articles