{
  "title": "simonecorsi/mawesome GitHub Action Tag Hijack",
  "summary": "Mutable refs for simonecorsi/mawesome including latest, v1, v2, and v2.2.0 currently resolve to a composite action that installs Bun and always runs an obfuscated JavaScript payload, exposing GitHub Actions runners that still trust those tags.",
  "date": "2026-06-25",
  "severity": "critical",
  "tags": [
    "supply-chain",
    "github-actions",
    "ci-cd",
    "credential-theft",
    "tag-hijack"
  ],
  "sources_count": 6,
  "indicators": {
    "slug": "simonecorsi-mawesome-tag-hijack",
    "since": "2026-06-24",
    "until": "unknown",
    "ecosystem": "GitHub Actions",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [
      "simonecorsi/mawesome"
    ],
    "packages": [
      "simonecorsi/mawesome"
    ],
    "versions": [
      "simonecorsi/mawesome@latest",
      "simonecorsi/mawesome@v1",
      "simonecorsi/mawesome@v2",
      "simonecorsi/mawesome@v2.2.0"
    ],
    "affectedVersions": [
      "simonecorsi/mawesome@latest",
      "simonecorsi/mawesome@v1",
      "simonecorsi/mawesome@v2",
      "simonecorsi/mawesome@v2.2.0"
    ],
    "fixedVersions": [],
    "files": [
      "action.yml",
      "index.js"
    ],
    "paths": [],
    "services": [],
    "domains": [],
    "urls": [
      "https://raw.githubusercontent.com/simonecorsi/mawesome/v1/action.yml",
      "https://raw.githubusercontent.com/simonecorsi/mawesome/main/action.yml",
      "https://raw.githubusercontent.com/simonecorsi/mawesome/v1/index.js"
    ],
    "ips": [],
    "hashes": [
      "e339407b8e34dc1540290d1d310bccafbc6028ca",
      "4a665037e0619e2181c7cccc3291d75104175a92",
      "6e26314c306ed5ea744eb90ebc6f3f70298abcb5",
      "7a59a7d02b1fdf6432ea9467b8e31357217288f7"
    ],
    "processPatterns": [
      "oven-sh/setup-bun",
      "bun run $GITHUB_ACTION_PATH/index.js",
      "createCipheriv",
      "createDecipheriv",
      "pbkdf2Sync",
      "VAULT_TOKEN",
      "ARM_CLIENT_SECRET",
      "GOOGLE_APPLICATION_CREDENTIALS",
      "X-GitHub-Api-Version"
    ],
    "networkPatterns": [],
    "telemetrySelectors": []
  }
}