Secret Cyber Assault Unveiled: GitHub Action Vulnerability Under Siege

Secret Cyber Assault Unveiled: GitHub Action Vulnerability Under Siege

The short version

• What broke: The popular tj-actions/changed-files GitHub Action was tampered with and began printing CI secrets into workflow logs (CVE-2025-30066).
• Where it started: Investigators traced it to an earlier compromise of reviewdog/action-setup (CVE-2025-30154), and Palo Alto Networks Unit 42 found the first target was a Coinbase open-source project.
• Status: Maintainers of tj-actions and reviewdog had cleaned up by March 20, 2025. CISA added both CVEs to its Known Exploited Vulnerabilities catalog.
• Who should look: Any team whose workflows referenced the action by tag between March 14 and 15, 2025.

How the tj-actions attack worked

On March 14, 2025, security researchers noticed that tj-actions/changed-files, an action used by more than 23,000 repositories to list the files changed in a pull request, was behaving oddly. Someone holding a token for the project’s bot account had pointed existing version tags at a malicious commit. Every workflow that pulled the action by tag ran it.

A tag is not a lock

The injected code dumped the memory of the CI runner and wrote secrets into the job log. In public repositories those logs are public, so access keys, GitHub personal access tokens, npm tokens and private RSA keys could be read by anyone. Workflows pinned to a full commit SHA kept running the code their owners had chosen.

Security researcher Adnan Khan pointed investigators toward reviewdog. Unit 42 later confirmed the chain: tj-actions used an action that depended on reviewdog/action-setup, which had itself been hijacked days earlier. The attacker tried Coinbase’s agentkit project first. Unit 42 said the attacker could not use Coinbase secrets or publish packages.

One dependency, thousands of pipelines

The incident shows how far trust stretches in the security of supply chains in open-source projects. One maintainer token, a few moved tags, and thousands of build pipelines ran code nobody had reviewed. The reviewdog actions action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep and action-typos were also listed as possibly affected.

What maintainers and GitHub did

The malicious commits were reverted and the gist hosting the payload script was removed. tj-actions shipped a fixed release (CISA cites v46.0.1), and reviewdog rotated credentials and locked down its organization. CISA published guidance on March 18 and updated it as the investigation went on.

Teams that ran the action should audit workflow runs in the exposure window, check logs for secrets (they may appear double-encoded in base64), and rotate anything that leaked. Going forward, pin third-party actions to a commit SHA and give workflow tokens the least privilege they need.

Lessons for build pipelines

Version tags in GitHub Actions can be moved. That single fact made this attack possible.

Pinning, allow-lists for third-party actions and alerts on unexpected workflow changes would have stopped most of the damage. Many teams adopted them only after March 2025.

Where things stand

Both CVEs remain in CISA’s catalog of exploited vulnerabilities, and Unit 42’s write-up is the most detailed public account of how one stolen token turned into a mass secret leak.

If your repositories used either action, the fix is the same as on day one: find the runs, read the logs, rotate the secrets.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.