Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets
aikido.dev | blog | #supply-chain | #devsecops | #secrets | #github-actions | #npm | #ci-cd | #supply-chain-attack | #supply-chain-security | #secrets-theft | #tag-hijacking | #semantic-release | #imposter-commits | #imposter-commit
Summary
codfish/semantic-release-action was hit by an imposter commit attack: force-pushed commits repointed 16 tags including v2-v5, so workflows pinning them run attacker code with CI/CD secrets access.
- Published
- Collected
--- id: 2416 title: "Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets" source_domain: aikido.dev source_url: "https://www.aikido.dev/blog/compromised-github-action-codfish-steals-secrets" published_at: "2026-06-24 00:00" tags: ["supply-chain", "devsecops", "secrets", "github-actions", "npm", "ci-cd", "supply-chain-attack", "supply-chain-security", "secrets-theft", "tag-hijacking", "semantic-release", "imposter-commits", "imposter-commit"] phying_url: "https://phying.com/item/2416" lang: en --- # Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets ## Summary codfish/semantic-release-action was hit by an imposter commit attack: force-pushed commits repointed 16 tags including v2-v5, so workflows pinning them run attacker code with CI/CD secrets access. ## Intelligence Metadata - **Sources:** aikido.dev - **Published:** 2026-06-24 00:00 - **Original:** https://www.aikido.dev/blog/compromised-github-action-codfish-steals-secrets - **Phying News:** https://phying.com/item/2416