Poisoned Pipeline / Incidents / AS118
codfish/semantic-release-action tag hijack (Miasma)
Aikido (24 Jun 2026): an imposter force-push grafted two malicious
commits and moved sixteen tags including floating v2–v5 on
codfish/semantic-release-action. Composite action still runs the real
action (so CI looks green), then setup-bun and an obfuscated index.js.
Dead-drop marker thebeautifulsnadsoftime matches the Miasma toolkit
(AS50). Workflows on mutable tags pull attacker code on the next run.
Mapped techniques
- T0195 Spoofed Commits
- T0122 Vulnerability in third-party CI/CD actions
- T0140 Harvest tokens from environment variables
- T0168 Exfiltration to code repositories
supply-chain floating tag rewrite
Orphan commits reused a 2023 merge author/date/message.
Mutable major tags v2–v5 repointed.
GITHUB_TOKEN / NPM_TOKEN on release workflows.
Miasma GitHub commit-search dead drop.