tj-actions Supply Chain Attack Exposes 23,000 Organizations
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-30066 | Supply Chain Compromise of tj-actions/changed-files GitHub Action Exposes CI/CD Secrets CVE-2025-30066 is not a traditional code bug but a supply chain compromise: on 2025-03-14 and 2025-03-15, a threat actor modified the code behind every published tag (v1 through v45.0.7) of the widely used tj-actions/changed-files GitHub Action to point at commit 0e58ed8, which contained malicious 'updateFeatures' code. The flaw is triggered whenever a GitHub Actions workflow invokes any of these affected tags during the compromise window; the embedded code dumps the runner's environment variables into the workflow logs. Anyone able to read the actions logs — including public logs on public repositories — can discover repository secrets such as GitHub tokens, API keys, and cloud credentials, enabling account takeover and lateral movement. Public reporting indicates roughly 23,000 repositories/organizations were affected, with Coinbase initially targeted and 218 of its repositories' CI/CD secrets exposed; the attack was traced back to a compromised GitHub token. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-03-18, and both GitGuardian and StepSecurity published detection and incident analyses. Do: Update workflows from tj-actions/changed-files to v46 or later, or better, pin the action to a verified commit SHA rather than a mutable tag. Review all workflow run logs generated between 2025-03-14 and 2025-03-15 for dumped environment variables and rotate every credential that could have been exposed (GitHub PATs, cloud keys, deploy tokens), checking downstream systems and logs for abuse of those secrets. | 8.6 | 70% | KEV PoC ×2 |
| large≈23,000+ repositories and their organizations (public incident reporting counted over 23,000 affected repositories) |
Full article323 words · extracted from infosecurity-magazine.com · click to collapse
Over 23,000 organizations unwittingly had their secrets exposed over the weekend after threat actors managed to compromise a popular GitHub Action.
GitHub Actions is a continuous integration and continuous delivery (CI/CD) platform designed to streamline the building, testing and deployment of code.
On Friday, security researchers spotted that the source code of the popular tj-actions/changed-files GitHub Action had been tampered with.
“In this attack, the attackers modified the action’s code and retroactively updated multiple version tags to reference the malicious commit. The compromised Action prints CI/CD secrets in GitHub Actions build logs,” explained StepSecurity.
“If the workflow logs are publicly accessible (such as in public repositories), anyone could potentially read these logs and obtain exposed secrets. There is no evidence that the leaked secrets were exfiltrated to any remote network destination.”
Read more on supply chain attacks: GitHub Bug Exposed Repositories to Hijacking
The incident has been given an official CVE number: CVE-2025-30066. All versions of the Action were impacted, but GitHub has now removed it, so users will have to find alternative implementations.
“The attacker was likely not looking for secrets in public repositories – they are already public. They were likely looking to compromise the software supply chain for other open source libraries, binaries, and artifacts created with this. Any public repository that creates packages or containers as part of a CI pipeline could have been impacted. That means potentially thousands of open source packages have the potential to have been compromised,” wrote Endor Labs.
“This can also apply to enterprise organizations that have both private and public repositories. If these repositories share CI/CD pipeline secrets for artifact or container registries these registries can be potentially compromised.”
The security vendor said it had no evidence at the time of writing that any downstream open source libraries or containers had been impacted, but called on maintainers and security researchers to watch closely for secondary compromises.
Image credit: Michael Vi / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/tjactions-supply-chain-attack/