tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs
tj-actions/changed-files GitHub Action
Attackers repointed the version tags of the popular tj-actions/changed-files GitHub Action to a commit that dumped runner memory, printing CI/CD secrets into workflow logs. It started with the compromise of reviewdog/action-setup and was aimed at Coinbase's agentkit repo first. Over 23,000 repositories used the action.
Why this severity: Supply-chain compromise; secrets leaked in public logs; CISA KEV
- Started
- Mar 14, 2025
- Closed
- Mar 20, 2025
Affected
- tj-actions/changed-files through 45.0.7 (tags repointed March 14-15, 2025)
Fixed in
- 46.0.1 (see GitHub advisory GHSA-mw4p-6x4p-x5m5)
Timeline6
tj-actions and reviewdog maintainers finish remediation
SourceCISA adds CVE-2025-30066 to KEV; reviewdog actions found compromised too
GitHub removes the action, then restores a cleaned repository
SourceCoinbase agentkit runs the malicious action and leaks a write token (15:10 UTC)
SourceAll tj-actions/changed-files tags replaced with malicious commits (16:57 UTC); StepSecurity detects it
SourceMalicious commit pushed to reviewdog/action-setup v1 tag
Reverted about two hours later.
Source
Advisories3
News & write-ups4
- Harden-Runner detection: tj-actions/changed-files action is compromisedStepSecurity · Mar 14, 2025 · Write-up
- GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to tj-actions/changed-filesUnit 42 · Write-up
- GitHub Action supply chain attack: reviewdog/action-setupWiz · Mar 17, 2025 · Write-up
- Coinbase was primary target of recent GitHub Actions breachesBleepingComputer
Notes & caveats
Fixed version 46.0.1 is from the GitHub advisory; verify there. reviewdog/action-setup has its own KEV entry (CVE-2025-30154).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
