GitHub Action Breach Unleashes Secrets, Exposing Supply Chain Vulnerabilities

At a glance

• GitHub Action Breach: The popular tj-actions/changed-files action was compromised in March 2025, leaking secrets from build logs.
• Critical Supply Chain Risk: More than 23,000 repositories used the action, tracked as CVE-2025-30066.
• Call for Enhanced Security: CISA told users to check their logs and rotate any exposed credentials.
• Impact on Developers: Teams are reviewing how they pin and trust third-party actions.

A widely used action turned malicious

On March 14 and 15, 2025, attackers compromised tj-actions/changed-files, a third-party GitHub Action used in more than 23,000 repositories. They pointed the action’s release tags at a malicious commit. When workflows ran, the code dumped CI secrets such as API keys and access tokens into the build logs. For public repositories, those logs could be read by anyone.

GitHub Actions is widely used to automate builds and tests because it is built into GitHub. Many teams reference third-party actions by version tag, trusting that the code behind the tag won’t change. This attack broke that assumption. The issue is tracked as CVE-2025-30066, and a related compromise of reviewdog/action-setup is tracked as CVE-2025-30154.

Why tags can’t be trusted

The breach exposed a weakness in how CI pipelines pull in outside code, because a single popular action, changed without notice by someone who had gained control of it, reached thousands of projects at once and ran with whatever secrets those projects had given their workflows.

Supply chain risks like this are easy to miss. Security researchers have warned for years that mutable tags and broad pipeline permissions let one compromised dependency spread widely. This incident proved the point.

What CISA and researchers recommend

CISA issued an alert on March 18, 2025. Its advice: check workflows that ran affected versions (45.0.7 and earlier) between March 12 and March 15, look in logs for encoded payloads, rotate any secrets that could have leaked, and move to a fixed version such as v46.0.1 or a safe replacement.

Security firms including StepSecurity and Wiz published technical details and detection guidance soon after the compromise was found.

Longer term, the main advice is to pin actions to a full commit SHA instead of a tag, so a changed tag can’t silently swap the code.

What developers should change

Developers now face more checks on what runs in their pipelines. Worth it.

The incident is a reminder to keep secrets out of logs and to limit what each workflow can access. Short-lived credentials and secret scanning help contain the damage when something slips.

Technology leaders should train teams on pipeline security, so developers spot risky dependencies before they ship.

Lessons from the tj-actions compromise

The tj-actions breach showed how one compromised component can reach thousands of software projects. Pinning dependencies, limiting permissions and watching build logs would have reduced the damage.

Teams that act on those lessons now will be better prepared for the next attack on the build pipeline.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.