erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: March 14, 2025

1 editorial brief and 5 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: tj-actions/changed-files compromise. Anyone whose workflows ran tj-actions/changed-files on March 14-15, 2025, or a reviewdog action on March 11, 2025, especially in public repositories, and who never rotated the secrets those jobs could read.
  • npm: 3 critical advisories (xml-crypto, flowise). Check with npm audit (or: npm ls <package>).
  • RubyGems: 1 critical advisory (camaleon_cms). Check with bundle audit check --update.
  • PyPI: 1 critical advisory (qiskit-terra, qiskit). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Supply-chain compromise · CVE-2025-30066, CVE-2025-30154

tj-actions/changed-files: GitHub Action Leaked CI Secrets

The malicious tags were cleaned up within about a day in March 2025; today the job is confirming you rotated any secret that a March 14-15, 2025 workflow run could have printed, and that you pin Actions by SHA.

Must act: Anyone whose workflows ran tj-actions/changed-files on March 14-15, 2025, or a reviewdog action on March 11, 2025, especially in public repositories, and who never rotated the secrets those jobs could read.

Can relax: Teams that never used these Actions, or that already audited those runs, deleted leaking logs and rotated secrets in March 2025.

  1. Search all repositories for uses of tj-actions/changed-files and reviewdog/action-* (code search plus a grep of .github/workflows).
  2. For each run on March 14-15, 2025 (tj-actions) or March 11, 2025 (reviewdog), open the logs and look for double base64-encoded blobs in the changed-files step.
  3. Rotate every secret those jobs could read and delete the leaking workflow run logs.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 5

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 3

Check: npm audit (or: npm ls <package>)

PyPI 1

Check: pip-audit (or: pip show <package>)

RubyGems 1

Check: bundle audit check --update