Listen to this Post
A recent supply chain attack has shaken the software development community, compromising the widely used tj-actions/changed-files GitHub action. This breach has affected 218 GitHub repositories, exposing sensitive information and raising concerns about the security of open-source software. Initially, estimates suggested up to 23,000 repositories were impacted, but further investigations have revealed a more contained—yet still significant—threat.
The attack originated from a single stolen token in a spotbugs workflow, which granted hackers unauthorized access to various GitHub projects. While the ultimate target was Coinbase, one of the world’s leading cryptocurrency exchanges, the attack was foiled before any major damage could be done. However, the attack highlights vulnerabilities in CI/CD pipelines and raises alarms about the security of GitHub Actions—a key automation tool for many developers.
Now, security experts are unraveling the details of how the attack unfolded, how it was mitigated, and what developers can do to protect their repositories from similar threats.
How the tj-actions/changed-files Attack Happened
On March 14, 2025, security researchers discovered that the source code of tj-actions/changed-files had been maliciously modified. This GitHub Action is widely used in Continuous Integration and Continuous Deployment (CI/CD) pipelines, making its compromise a significant security risk.
Key Details of the Attack
- The attackers altered the code and updated multiple version tags to reference a malicious commit.
- The compromised version printed CI/CD secrets into GitHub build logs.
- If these logs were publicly accessible, anyone could extract the leaked secrets.
- Attackers used a previously compromised project (reviewdog/action-setup) to insert a backdoor, which was triggered when tj-actions/eslint-changed-files was executed.
Tracing the Attack’s Origin
- The initial breach happened in November 2024, when attackers exploited a GitHub Actions workflow in spotbugs.
- A malicious pull request allowed attackers to steal a Personal Access Token (PAT) from a reviewdog maintainer.
- This stolen PAT gave the attackers write access to the reviewdog/action-setup repository, which was later used to compromise tj-actions/changed-files.
Coinbase as the Primary Target
- On March 20, 2025, researchers at Palo Alto Networks’ Unit42 revealed that Coinbase’s GitHub project (agentkit) was the primary target.
- The attackers attempted to manipulate Coinbase’s CI/CD pipeline to escalate their access.
- However, Coinbase’s security measures prevented a full-scale breach, limiting the damage to 218 repositories.
Timeline of the Attack
- November 2024: Attackers infiltrate spotbugs via a GitHub Actions workflow.
- December 6, 2024: A stolen PAT allows further lateral movement into reviewdog repositories.
- March 11, 2025: Attackers inject a malicious workflow into reviewdog/action-setup.
- March 14, 2025: tj-actions/changed-files is compromised, exposing 218 repositories.
- March 15, 2025: The vulnerability is assigned CVE-2025-30066.
- March 20, 2025: Investigations reveal Coinbase was the target.
- April 2, 2025: Researchers trace the attack back to a stolen token in spotbugs.
This attack demonstrates the serious risks posed by compromised GitHub Actions and underscores the importance of securing CI/CD pipelines.
What Undercode Says: Analyzing the Supply Chain Breach
1. The Increasing Threat of CI/CD Pipeline Attacks
CI/CD pipelines have become a prime target for cybercriminals. Attackers understand that compromising automation tools allows them to infiltrate a large number of projects at once. The use of GitHub Actions in this attack underscores how automated workflows can be leveraged for malicious purposes.
2. Why This Attack Was Different
Unlike traditional data breaches, where attackers seek to steal information directly, this attack focused on software supply chain poisoning. The goal was to:
– Embed malicious code into widely used repositories.
- Compromise open-source libraries used by thousands of projects.
– Manipulate CI/CD pipelines to spread malware further.
Had this attack not been stopped, thousands of open-source projects could have been infected, creating a ripple effect across the software industry.
- The Role of GitHub Actions in Security Risks
GitHub Actions are a powerful automation tool, but they also introduce new security risks:
– Overly permissive workflows (like pull_request_target) can be exploited.
– Stolen access tokens provide unauthorized write access.
- Lack of strict security policies allows attackers to tamper with builds.
4. The Importance of Security Best Practices
To prevent future attacks, developers must adopt strong security measures:
– Use fine-grained permissions for GitHub tokens.
– Regularly rotate and audit access tokens.
– Enable security alerts for GitHub repositories.
– Verify dependencies before using third-party actions.
– Restrict workflow permissions to limit exposure.
5. The Future of Supply Chain Security
With more organizations relying on open-source software, supply chain attacks will continue to evolve. Companies must:
– Invest in real-time threat detection for CI/CD pipelines.
– Encourage security audits for widely used open-source actions.
– Develop automated security testing to detect unauthorized code changes.
GitHub and other platforms need stronger built-in protections to prevent such attacks from spreading undetected.
Fact Checker Results
✅ The attack was officially assigned CVE-2025-30066 and recognized by CISA.
✅ Coinbase was not fully compromised, but the attack targeted its open-source projects.
✅ The actual number of affected repositories was 218, not 23,000 as initially feared.
This attack serves as a critical reminder that supply chain security is a growing challenge in modern software development. Organizations must stay vigilant and implement proactive security measures to defend against future threats.
References:
Reported By: https://www.infosecurity-magazine.com/news/tj-actions-supply-chain-attack/
Extra Source Hub:
https://www.discord.com
Wikipedia
Undercode AI
Image Source:
Pexels
Undercode AI DI v2
