# multiple-github-actions-npm-packages-compromised-teampcp-miasma-like: Multiple GitHub Actions & npm Packages Compromised (TeamPCP, Miasma-like)

> Multiple GitHub Actions & npm Packages Compromised (TeamPCP, Miasma-like) is a high-severity supply chain compromise issue in codfish/semantic-release-action, a CI integration. Affected: codfish/semantic-release-action (tags v2-v5 + others repointed) + npm packages (June 24-26 2026).

- **Canonical URL:** https://catalog.anomity.ai/vuln/multiple-github-actions-npm-packages-compromised-teampcp-miasma-like
- **Aliases:** ti-041
- **Severity:** high
- **Attack type:** Supply chain compromise
- **Component:** codfish/semantic-release-action (CI integration)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-06-25
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/multiple-github-actions-npm-packages-compromised-teampcp-miasma-like

## Summary

Between June 24-26 2026, repositories of multiple GitHub Actions (e.g. codfish/semantic-release-action, simonecorsi/mawesome) were compromised with malware similar to Miasma and their version tags redirected to malicious commits; additional npm packages were then compromised with a matching payload. Attributed to TeamPCP.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| codfish/semantic-release-action (tags v2-v5 + others repointed) + npm packages (June 24-26 2026) | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run codfish/semantic-release-action (tags v2-v5 + others repointed) + npm packages (June 24-26 2026).

## How do I fix it?

Pin GitHub Actions to a full commit SHA (not a moving tag), audit SBOMs for the affected Actions and npm package versions, and review CI logs for the June 24-26 window. Rotate any secrets exposed to affected workflows.

## References

- article: https://www.aikido.dev/blog/compromised-github-action-codfish-steals-secrets

## Related vulnerabilities

- [ghostaction-returns-a-security-audit-yml-workflow-pushed-from](https://catalog.anomity.ai/vuln/ghostaction-returns-a-security-audit-yml-workflow-pushed-from) — high
- [binding-gyp-supply-chain-attack-enables-npm-ci-cd-worm-propagation](https://catalog.anomity.ai/vuln/binding-gyp-supply-chain-attack-enables-npm-ci-cd-worm-propagation) — high
- [trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace](https://catalog.anomity.ai/vuln/trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace) — critical
- [load-mine-31-fake-qwen2-repositories-on-hugging-face-and-modelscope](https://catalog.anomity.ai/vuln/load-mine-31-fake-qwen2-repositories-on-hugging-face-and-modelscope) — high
- [forever-security-an-agents-md-planted-in-downloads-got-codex-to](https://catalog.anomity.ai/vuln/forever-security-an-agents-md-planted-in-downloads-got-codex-to) — high
- [beyondtrust-a-hidden-comment-on-a-github-issue-hijacked-the-copilot](https://catalog.anomity.ai/vuln/beyondtrust-a-hidden-comment-on-a-github-issue-hijacked-the-copilot) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=multiple-github-actions-npm-packages-compromised-teampcp-miasma-like