Tj-actions Supply Chain Attack Traced Back to GitHub Token Compromise
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-30066 | Supply Chain Compromise of tj-actions/changed-files GitHub Action Exposes CI/CD Secrets | 8.6 | 72% | KEVPoC ×2 | KEV |
From the original article
4 min read at infosecurity-magazine.com
A recent supply chain attack that compromised the popular tj-actions/changed-files GitHub action has left a trail of digital destruction, affecting 218 GitHub repositories. As investigators dig deeper, the origins of this sophisticated breach are slowly coming into focus, revealing both the initial compromise and the ultimate target.
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.