{
  "title": "codfish/semantic-release-action GitHub Action Tag Hijack",
  "summary": "An attacker force-pushed a malicious composite action into codfish/semantic-release-action and moved fifteen published tags to that commit, exposing GitHub Actions runners that still trusted mutable refs such as v3, v4, and v5.",
  "date": "2026-06-24",
  "severity": "critical",
  "tags": [
    "supply-chain",
    "github-actions",
    "ci-cd",
    "credential-theft",
    "tag-hijack"
  ],
  "sources_count": 5,
  "indicators": {
    "slug": "codfish-semantic-release-action-tag-hijack",
    "since": "2026-06-24T15:39:06Z",
    "until": "unknown",
    "ecosystem": "GitHub Actions",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [
      "codfish/semantic-release-action"
    ],
    "packages": [
      "codfish/semantic-release-action"
    ],
    "versions": [
      "codfish/semantic-release-action@v5.0.0",
      "codfish/semantic-release-action@v5",
      "codfish/semantic-release-action@v4.0.1",
      "codfish/semantic-release-action@v4.0.0",
      "codfish/semantic-release-action@v4",
      "codfish/semantic-release-action@v3.5.0",
      "codfish/semantic-release-action@v3.4.1",
      "codfish/semantic-release-action@v3.4.0",
      "codfish/semantic-release-action@v3.3.0",
      "codfish/semantic-release-action@v3.2.0",
      "codfish/semantic-release-action@v3.1.1",
      "codfish/semantic-release-action@v3.1.0",
      "codfish/semantic-release-action@v3.0.0",
      "codfish/semantic-release-action@v3",
      "codfish/semantic-release-action@v2.2.1"
    ],
    "affectedVersions": [
      "codfish/semantic-release-action@v5.0.0",
      "codfish/semantic-release-action@v5",
      "codfish/semantic-release-action@v4.0.1",
      "codfish/semantic-release-action@v4.0.0",
      "codfish/semantic-release-action@v4",
      "codfish/semantic-release-action@v3.5.0",
      "codfish/semantic-release-action@v3.4.1",
      "codfish/semantic-release-action@v3.4.0",
      "codfish/semantic-release-action@v3.3.0",
      "codfish/semantic-release-action@v3.2.0",
      "codfish/semantic-release-action@v3.1.1",
      "codfish/semantic-release-action@v3.1.0",
      "codfish/semantic-release-action@v3.0.0",
      "codfish/semantic-release-action@v3",
      "codfish/semantic-release-action@v2.2.1"
    ],
    "fixedVersions": [],
    "files": [
      "action.yml",
      "index.js"
    ],
    "paths": [],
    "services": [],
    "domains": [],
    "urls": [
      "https://raw.githubusercontent.com/codfish/semantic-release-action/5792aba0e2180b9b80b77644370a6889d5817456/action.yml",
      "https://raw.githubusercontent.com/codfish/semantic-release-action/8f9a58f2acdc190c356f79159b5de2548cdb63cd/action.yml"
    ],
    "ips": [],
    "hashes": [
      "5792aba0e2180b9b80b77644370a6889d5817456",
      "8f9a58f2acdc190c356f79159b5de2548cdb63cd"
    ],
    "processPatterns": [
      "oven-sh/setup-bun",
      "bun run $GITHUB_ACTION_PATH/index.js",
      "Runner.Worker memory access"
    ],
    "networkPatterns": [],
    "telemetrySelectors": []
  }
}