---
title: "tj-actions/changed-files: GitHub Action Leaked CI Secrets"
url: https://erroneo.us/security/briefs/tj-actions-changed-files-compromise/
description: "Attackers repointed tj-actions/changed-files tags to dump CI secrets into logs (CVE-2025-30066), via reviewdog. Fixed in v46.0.1. Verdict: check exposure."
type: security-brief
section: "Security Digest"
date_published: 2025-03-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-30066", "CVE-2025-30154"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# tj-actions/changed-files: GitHub Action Leaked CI Secrets

**Verdict: Check exposure.** The malicious tags were cleaned up within about a day in March 2025; today the job is confirming you rotated any secret that a March 14-15, 2025 workflow run could have printed, and that you pin Actions by SHA.

- **Who must act:** Anyone whose workflows ran tj-actions/changed-files on March 14-15, 2025, or a reviewdog action on March 11, 2025, especially in public repositories, and who never rotated the secrets those jobs could read.
- **Who can relax:** Teams that never used these Actions, or that already audited those runs, deleted leaking logs and rotated secrets in March 2025.
- **Affected:** tj-actions/changed-files tags v1 through v45.0.7 while repointed to commit 0e58ed8 (March 14-15, 2025); reviewdog/action-setup@v1 on March 11, 2025, 18:42-20:31 UTC, plus reviewdog actions that call it
- **Fixed:** tj-actions/changed-files v46.0.1; reviewdog/action-setup commit 3f401fe
- **CVEs:** CVE-2025-30066, CVE-2025-30154
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Search all repositories for uses of tj-actions/changed-files and reviewdog/action-* (code search plus a grep of .github/workflows).
2. For each run on March 14-15, 2025 (tj-actions) or March 11, 2025 (reviewdog), open the logs and look for double base64-encoded blobs in the changed-files step.
3. Rotate every secret those jobs could read and delete the leaking workflow run logs.
4. Upgrade to tj-actions/changed-files v46.0.1 or later, or replace it, and pin all third-party Actions to full commit SHAs.
5. Remove pull_request_target workflows that touch secrets and keep GITHUB_TOKEN permissions read-only by default.

### How to check if you are affected

- grep -rn 'tj-actions/changed-files\|reviewdog/action-' .github/workflows
- Search workflow logs from the affected windows for long base64 strings printed by the changed-files step.
- Look for runs that contacted gist.githubusercontent.com or that reference commit 0e58ed8671d6b60d0890c21b07f8835ace038e67.
- Review audit logs for use of any token those runs exposed after March 11, 2025.

## What happened

On March 14, 2025, an attacker retroactively moved most release tags of `tj-actions/changed-files`, a GitHub Action used by more than 23,000 repositories, to point at a malicious commit, `0e58ed8`. The [GitHub advisory](https://github.com/advisories/GHSA-mrrh-fwg8-r2c3) says the injected code downloaded a Python script from a gist and ran it with `sudo python3`. The script read the memory of the runner's `Runner.Worker` process, pulled out secrets, and printed them, base64-encoded, into the build log. [StepSecurity](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised) spotted the unexpected call to `gist.githubusercontent.com` at about 16:00 UTC and found no evidence that secrets were sent to an outside server. They were printed to logs, and on public repositories anyone could read those logs.

The way in was a second compromise. The [CVE-2025-30154 record](https://cveawg.mitre.org/api/cve/CVE-2025-30154) says `reviewdog/action-setup@v1` was compromised on March 11, 2025, between 18:42 and 20:31 UTC. [Unit 42](https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/) traced the chain further back. A PAT leaked from a spotbugs workflow through a `pull_request_target` pull request in December 2024. That led to a reviewdog maintainer's token, and then to tj-actions' bot PAT, which was stolen when `tj-actions/eslint-changed-files` ran the poisoned reviewdog step. Unit 42 also found that the first target was Coinbase. The attacker had forked `coinbase/agentkit`, and at 15:10 UTC on March 14 that project's workflow leaked a write-capable token. Coinbase removed the workflow and said the attack did no damage. Unit 42 thinks the attacker then switched all tj-actions tags to the noisy log-dumping payload at 16:57 UTC.

## Who is affected

The [CVE-2025-30066 record](https://cveawg.mitre.org/api/cve/CVE-2025-30066) covers tags v1 through v45.0.7 while they pointed at `0e58ed8` on March 14-15, 2025. [CISA](https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction) defines the window as 2025-03-12 00:00 UTC to 2025-03-15 12:00 UTC. For reviewdog, CISA also names `action-shellcheck`, `action-composite-template`, `action-staticcheck`, `action-ast-grep` and `action-typos`, which were affected however they were pinned. A workflow that pinned tj-actions to a full, known-good commit SHA was not affected, because the attacker only moved tags. CISA added both CVEs to the Known Exploited Vulnerabilities catalog. The local KEV snapshot dates them March 18 (CVE-2025-30066) and March 24, 2025 (CVE-2025-30154). CISA's alert text says March 26.

## Do you really need to act?

Only if you never checked. The bad tags were live for about a day, and StepSecurity reports that GitHub restored a clean repository on March 15, 2025. The fix is v46.0.1. The real damage is any secret that was printed. A token leaked in March 2025 and never rotated is still valid today, and public logs could have been scraped while they were up. If your runs in the window touched production credentials, treat this as unfinished. If you audited and rotated in March 2025, you are done.

## What to do now

1. Inventory usage: `grep -rn "tj-actions/changed-files\|reviewdog/action-" .github/workflows` across every repository, and use org-wide code search too, since search can miss some uses.
2. For runs in the windows above, read the changed-files step output. Decode suspicious base64 blobs (they were double-encoded) to see which secrets leaked.
3. Rotate those secrets and delete the logs that leaked them.
4. Move to v46.0.1 or later, or replace the Action, and pin every third-party Action to a full 40-character SHA.
5. Remove `pull_request_target` workflows that can reach secrets, and default `GITHUB_TOKEN` to read-only. Coinbase's workflow ran with write-all.

## How to tell if you were hit

Look in workflow logs for long base64 strings printed by the changed-files step, for references to commit `0e58ed8671d6b60d0890c21b07f8835ace038e67`, and for outbound calls to `gist.githubusercontent.com` if you have egress monitoring. Then check cloud, npm and GitHub audit logs for any use of an exposed credential after March 11, 2025. Unit 42 lists attacker accounts (for example `jurkaofavak`, `mmvojwip`) that you can grep for in organization audit logs.

## Timeline

- Dec 6, 2024 — A malicious pull request leaks a spotbugs maintainer PAT (Unit 42).
- Mar 11, 2025 — reviewdog/action-setup@v1 is malicious from 18:42 to 20:31 UTC.
- Mar 14, 2025 — Coinbase agentkit token leaks at 15:10 UTC. All tj-actions tags are repointed at 16:57 UTC. StepSecurity detects it.
- Mar 15, 2025 — Advisory and CVE published. The repository is restored. v46.0.1 is the fixed release.
- Mar 18, 2025 — CISA alert. CVE-2025-30066 is added to KEV.
- Mar 24, 2025 — CVE-2025-30154 is added to KEV (per the KEV catalog).

## Sources

1. [CISA — Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154)](https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction)
2. [GitHub Advisory Database — GHSA-mrrh-fwg8-r2c3](https://github.com/advisories/GHSA-mrrh-fwg8-r2c3)
3. [CVE Program — CVE-2025-30066 record](https://cveawg.mitre.org/api/cve/CVE-2025-30066)
4. [CVE Program — CVE-2025-30154 record](https://cveawg.mitre.org/api/cve/CVE-2025-30154)
5. [Palo Alto Networks Unit 42 — GitHub Actions supply chain attack analysis](https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/)
6. [StepSecurity — Harden-Runner detection: tj-actions/changed-files action is compromised](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised)

---
Source page: https://erroneo.us/security/briefs/tj-actions-changed-files-compromise/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt