On Friday, cybersecurity firm StepSecurity warned of a security incident impacting the tj-actions/changed-files GitHub Action, a popular tool used to track file changes and trigger other actions depending on those alterations. Mureinik told Recorded Future News that a GitHub Action is ultimately a piece of software, and like any piece of software there are solutions to ensure that the version being used is patched and up to date. The bug, referred to as CVE-2025-30066, allowed remote attackers to expose Continuous Integration and Continuous Deployment (CI/CD) secrets through the action’s build logs and impacts any users who rely on the tj-actions/changed-files action to track changed files within a pull request. “While it may be tempting to shrug all these considerations off as ‘the platform’s problem,’ the responsibility to ensure the security of a software project lies with those who build it, whether it’s built locally or by using a third-party service like GitHub,” Mureinik said. “Security professionals must audit their repositories for usage of the compromised Action and replace or remove it entirely, rotating all potentially exposed secrets including AWS keys, GitHub PATs, npm tokens, and RSA keys,” he said. GitHub was forced to take action this weekend to help users after a threat actor compromised a popular open source package used by more than 23,000 organizations. If logs are publicly accessible, such as in public repositories, unauthorized users could access and retrieve the clear text secrets, experts at Aqua Security explained. A spokesperson told Recorded Future News that there is no evidence to suggest a compromise of GitHub or its systems. Several experts who spoke to Recorded Future News said GitHub’s CI/CD ecosystem is a high-value target for hackers seeking to inject malicious code. According to StepSecurity, the attackers modified code in tj-actions/changed-files that affected public repositories and leaked secrets in logs. Users should always review GitHub Actions or any other package that they are using in their code before they update to new versions. Others, like Salt Security director Eric Schwake, noted that the incident was a prime example of why security teams must stay concerned about widely used and seemingly harmless tools being misused as vectors for attack.
This Cyber News was published on therecord.media. Publication date: Mon, 17 Mar 2025 20:40:26 +0000