CVE-2025-30154

The reviewdog/action-setup GitHub Action, which installs the reviewdog tool, was compromised in a supply chain attack on March 11, 2025, between 18:42 and 20:31 UTC, when malicious code was embedded in the action-setup@v1 tag (CWE-506). Any workflow that invoked reviewdog/action-setup@v1 during that window executed the malicious code, including runs of reviewdog/action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep, and action-typos, which all depend on action-setup@v1; because the v1 tag itself was modified, the compromise applied regardless of version or pinning method. The injected code dumped exposed secrets, such as CI/CD credentials, to GitHub Actions workflow logs, giving the attacker access to harvested tokens and secrets; public reporting links the campaign to an initial targeting of Coinbase and documents 218 repositories whose secrets were exposed. Only GitHub repositories whose workflows ran one of the six affected actions during the roughly two-hour window are affected. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-03-24, and EPSS estimates a 2.4% probability of exploitation in the next 30 days.

What to do: Audit GitHub Actions workflow logs for runs executed between March 11, 2025 18:42 and 20:31 UTC that invoked any of the six affected reviewdog actions, and rotate or revoke any secrets that appear in those logs (CI/CD tokens, cloud and API credentials). Update to the remediated action-setup@v1 or pin the action to a known-good full commit SHA, and apply mitigations per CISA/vendor instructions (BOD 22-01 guidance for cloud services) or discontinue use if mitigations are unavailable. Note that pinning to a mutable tag alone did not prevent this compromise, so prefer full-SHA pinning.