simonecorsi/mawesome GitHub Action has been compromised

On June 24, 2026, attackers compromised the simonecorsi/mawesome GitHub repository by force-pushing malicious commits and repointing version tags to those commits. Any workflow using the affected tags after that date executed the attacker's code within its GitHub Actions runner environment. This represents a supply chain attack targeting CI/CD pipelines. The attack vector involved tag manipulation, a common technique to silently inject malicious code into dependent workflows. Organizations using this GitHub Action in their pipelines were exposed to arbitrary code execution in their runner environments. The incident highlights risks associated with pinning GitHub Actions to mutable tags rather than immutable commit SHAs. Users of this action should audit their workflows and rotate any secrets exposed during the compromise window.