erroneo.us
Search all guides⌘K

Security Digest · Mar 14, 2025 · Supply-chain compromise · CI/CD

tj-actions/changed-files: GitHub Action Leaked CI Secrets

Attackers repointed tj-actions/changed-files tags to dump CI secrets into logs (CVE-2025-30066), via reviewdog. Fixed in v46.0.1. Verdict: check exposure.

Published By erroneo.us Security Desk · Updated 3 min read6 sources

Our verdict

Check exposure

The malicious tags were cleaned up within about a day in March 2025; today the job is confirming you rotated any secret that a March 14-15, 2025 workflow run could have printed, and that you pin Actions by SHA.

Who must act: Anyone whose workflows ran tj-actions/changed-files on March 14-15, 2025, or a reviewdog action on March 11, 2025, especially in public repositories, and who never rotated the secrets those jobs could read.

Who can relax: Teams that never used these Actions, or that already audited those runs, deleted leaking logs and rotated secrets in March 2025.

Affected
tj-actions/changed-files tags v1 through v45.0.7 while repointed to commit 0e58ed8 (March 14-15, 2025)
reviewdog/action-setup@v1 on March 11, 2025, 18:42-20:31 UTC, plus reviewdog actions that call it
Fixed in
tj-actions/changed-files v46.0.1
reviewdog/action-setup commit 3f401fe
CVSS
8.6 (v3.1, CNA)
EPSS
72.1% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Search all repositories for uses of tj-actions/changed-files and reviewdog/action-* (code search plus a grep of .github/workflows).
  2. For each run on March 14-15, 2025 (tj-actions) or March 11, 2025 (reviewdog), open the logs and look for double base64-encoded blobs in the changed-files step.
  3. Rotate every secret those jobs could read and delete the leaking workflow run logs.
  4. Upgrade to tj-actions/changed-files v46.0.1 or later, or replace it, and pin all third-party Actions to full commit SHAs.
  5. Remove pull_request_target workflows that touch secrets and keep GITHUB_TOKEN permissions read-only by default.

How to check if you are affected or compromised

  • grep -rn 'tj-actions/changed-files\|reviewdog/action-' .github/workflows
  • Search workflow logs from the affected windows for long base64 strings printed by the changed-files step.
  • Look for runs that contacted gist.githubusercontent.com or that reference commit 0e58ed8671d6b60d0890c21b07f8835ace038e67.
  • Review audit logs for use of any token those runs exposed after March 11, 2025.

What happened#

On March 14, 2025, an attacker retroactively moved most release tags of tj-actions/changed-files, a GitHub Action used by more than 23,000 repositories, to point at a malicious commit, 0e58ed8. The GitHub advisory says the injected code downloaded a Python script from a gist and ran it with sudo python3. The script read the memory of the runner's Runner.Worker process, pulled out secrets, and printed them, base64-encoded, into the build log. StepSecurity spotted the unexpected call to gist.githubusercontent.com at about 16:00 UTC and found no evidence that secrets were sent to an outside server. They were printed to logs, and on public repositories anyone could read those logs.

The way in was a second compromise. The CVE-2025-30154 record says reviewdog/action-setup@v1 was compromised on March 11, 2025, between 18:42 and 20:31 UTC. Unit 42 traced the chain further back. A PAT leaked from a spotbugs workflow through a pull_request_target pull request in December 2024. That led to a reviewdog maintainer's token, and then to tj-actions' bot PAT, which was stolen when tj-actions/eslint-changed-files ran the poisoned reviewdog step. Unit 42 also found that the first target was Coinbase. The attacker had forked coinbase/agentkit, and at 15:10 UTC on March 14 that project's workflow leaked a write-capable token. Coinbase removed the workflow and said the attack did no damage. Unit 42 thinks the attacker then switched all tj-actions tags to the noisy log-dumping payload at 16:57 UTC.

Who is affected#

The CVE-2025-30066 record covers tags v1 through v45.0.7 while they pointed at 0e58ed8 on March 14-15, 2025. CISA defines the window as 2025-03-12 00:00 UTC to 2025-03-15 12:00 UTC. For reviewdog, CISA also names action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep and action-typos, which were affected however they were pinned. A workflow that pinned tj-actions to a full, known-good commit SHA was not affected, because the attacker only moved tags. CISA added both CVEs to the Known Exploited Vulnerabilities catalog. The local KEV snapshot dates them March 18 (CVE-2025-30066) and March 24, 2025 (CVE-2025-30154). CISA's alert text says March 26.

Do you really need to act?#

Only if you never checked. The bad tags were live for about a day, and StepSecurity reports that GitHub restored a clean repository on March 15, 2025. The fix is v46.0.1. The real damage is any secret that was printed. A token leaked in March 2025 and never rotated is still valid today, and public logs could have been scraped while they were up. If your runs in the window touched production credentials, treat this as unfinished. If you audited and rotated in March 2025, you are done.

What to do now#

  1. Inventory usage: grep -rn "tj-actions/changed-files\|reviewdog/action-" .github/workflows across every repository, and use org-wide code search too, since search can miss some uses.
  2. For runs in the windows above, read the changed-files step output. Decode suspicious base64 blobs (they were double-encoded) to see which secrets leaked.
  3. Rotate those secrets and delete the logs that leaked them.
  4. Move to v46.0.1 or later, or replace the Action, and pin every third-party Action to a full 40-character SHA.
  5. Remove pull_request_target workflows that can reach secrets, and default GITHUB_TOKEN to read-only. Coinbase's workflow ran with write-all.

How to tell if you were hit#

Look in workflow logs for long base64 strings printed by the changed-files step, for references to commit 0e58ed8671d6b60d0890c21b07f8835ace038e67, and for outbound calls to gist.githubusercontent.com if you have egress monitoring. Then check cloud, npm and GitHub audit logs for any use of an exposed credential after March 11, 2025. Unit 42 lists attacker accounts (for example jurkaofavak, mmvojwip) that you can grep for in organization audit logs.

Timeline#

  • — A malicious pull request leaks a spotbugs maintainer PAT (Unit 42).
  • — reviewdog/action-setup@v1 is malicious from 18:42 to 20:31 UTC.
  • — Coinbase agentkit token leaks at 15:10 UTC. All tj-actions tags are repointed at 16:57 UTC. StepSecurity detects it.
  • — Advisory and CVE published. The repository is restored. v46.0.1 is the fixed release.
  • — CISA alert. CVE-2025-30066 is added to KEV.
  • — CVE-2025-30154 is added to KEV (per the KEV catalog).

Vulnerability records

  • CVE-2025-30066 · KEV 2025-03-18 · tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs.
  • CVE-2025-30154 · KEV 2025-03-24 · reviewdog/action-setup is a GitHub action that installs reviewdog.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. CISA — Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154) cisa.gov
  2. GitHub Advisory Database — GHSA-mrrh-fwg8-r2c3 github.com
  3. CVE Program — CVE-2025-30066 record cveawg.mitre.org
  4. CVE Program — CVE-2025-30154 record cveawg.mitre.org
  5. Palo Alto Networks Unit 42 — GitHub Actions supply chain attack analysis unit42.paloaltonetworks.com
  6. StepSecurity — Harden-Runner detection: tj-actions/changed-files action is compromised stepsecurity.io