The compromise of GitHub Action tj-actions/changed-files has impacted only a small percentage of the 23,000 projects using it, with it estimated that only 218 repositories exposed secrets due to the supply chain attack. According to data shared by Endor Labs that monitored the exposure of secrets resulting from said supply chain attack, the impact of the incident appears to be limited yet still significant. GitHub Action' tj-actions/changed-files' was compromised by attackers who added a malicious commit on March 14, 2025, to dump CI/CD secrets from the Runner Worker process to the repository. In most cases, the exposed secrets were GitHub install access tokens, which Endor says expire within 24 hours, leaving attackers only a limited exploitation window. Subsequent investigation showed that the attack was likely made possible via another supply chain attack targeting the "reviewdog/action-setup@v1" GitHub Action. That said, owners of exposed repositories must take immediate action to rotate their secrets before attackers get the chance to exploit the leakage. During the timeframe of the exposure, between March 14, 04:00 PM UTC, and March 15, 02:00 PM UTC, 5,416 repositories across 4,072 distinct organizations referenced the targeted GitHub Action. Of those 614, Endor says 218 actually printed secrets to the console log, with the rest being protected by following 'best-practice recommendations' that acted as a failsafe to prevent the exposure of secrets.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 20 Mar 2025 14:35:18 +0000