---
id: 2416
title: "Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/compromised-github-action-codfish-steals-secrets"
published_at: "2026-06-24 00:00"
tags: ["supply-chain", "devsecops", "secrets", "github-actions", "npm", "ci-cd", "supply-chain-attack", "supply-chain-security", "secrets-theft", "tag-hijacking", "semantic-release", "imposter-commits", "imposter-commit"]
phying_url: "https://phying.com/item/2416"
lang: en
---

# Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets

## Summary

codfish/semantic-release-action was hit by an imposter commit attack: force-pushed commits repointed 16 tags including v2-v5, so workflows pinning them run attacker code with CI/CD secrets access.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-06-24 00:00
- **Original:** https://www.aikido.dev/blog/compromised-github-action-codfish-steals-secrets
- **Phying News:** https://phying.com/item/2416