Multiple GitHub Actions & npm Packages Compromised (TeamPCP, Miasma-like)
Multiple GitHub Actions & npm Packages Compromised (TeamPCP, Miasma-like) is a high-severity supply chain compromise issue in codfish/semantic-release-action, a CI integration. Affected: codfish/semantic-release-action (tags v2-v5 + others repointed) + npm packages (June 24-26 2026).
Is codfish/semantic-release-action running on your developers' machines? Anomity inventories the AI agents, MCP servers, extensions and skills on every developer device, so you can see what this advisory touches. Detect this across your developers' devices with Anomity →
Key facts
- ID
multiple-github-actions-npm-packages-compromised-teampcp-miasma-like- Severity
- high
- Attack type
- Supply chain compromise
- Component
- codfish/semantic-release-action · CI integration
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
Between June 24-26 2026, repositories of multiple GitHub Actions (e.g. codfish/semantic-release-action, simonecorsi/mawesome) were compromised with malware similar to Miasma and their version tags redirected to malicious commits; additional npm packages were then compromised with a matching payload. Attributed to TeamPCP.
Affected versions
| Affected | Fixed in |
|---|---|
codfish/semantic-release-action (tags v2-v5 + others repointed) + npm packages (June 24-26 2026) | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run codfish/semantic-release-action (tags v2-v5 + others repointed) + npm packages (June 24-26 2026).
How do I fix it?
Pin GitHub Actions to a full commit SHA (not a moving tag), audit SBOMs for the affected Actions and npm package versions, and review CI logs for the June 24-26 window. Rotate any secrets exposed to affected workflows.