Last week, a supply chain attack on the tj-actions/changed-files GitHub Action caused malicious code to write CI/CD secrets to the workflow logs for 23,000 repositories. A cascading supply chain attack that began with the compromise of the "reviewdog/action-setup@v1" GitHub Action is believed to have led to the recent breach of "tj-actions/changed-files" that leaked CI/CD secrets. The cybersecurity firm reports that the attackers first compromised the v1 tag for the reviewdog/action-setup GitHub action and injected similar code to dump CI/CD secrets to log files. Those supply chain attacks and leaked CI/CD secrets are bound to have a lasting effect on impacted projects, so quick action is required to mitigate the risks. Notably, if the action remained compromised, a repeat attack on tj-actions/changed-files with a successful outcome would be practically possible, potentially exposing the just rotated CI/CD secrets. The tj-actions developers cannot pinpoint exactly how the attackers compromised a GitHub personal access token (PAT) used by a bot to perform malicious code changes. Developers should immediately remove all references to affected actions across branches, delete workflow logs, and rotate any potentially exposed secrets. As in the case of tj-actions, the exposed secrets would be visible on public repositories as part of the workflow logs.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 18 Mar 2025 20:05:15 +0000