On March 11, 2025, the attacker used the stolen PAT to invite another dummy user (jurkaofavak) into SpotBugs, who pushed a malicious GitHub Actions workflow that exfiltrated another PAT belonging to a Reviewdog maintainer (RD_MNTNR) who also had access to SpotBugs. A cascading supply chain attack on GitHub that targeted Coinbase in March has now been traced back to a single token stolen from a SpotBugs workflow, which allowed a threat actor to compromise multiple GitHub projects. The multi-step supply chain attack eventually exposed secrets in 218 repositories, while the latest findings showed that the threat actors were initially attempting to breach projects belonging to the cryptocurrency exchange Coinbase. Using stolen credentials, the attacker overrode git tags in the repository to point to a malicious commit that would dump secrets from CI runners into logs, potentially impacting 23,000 repositories using that action. We now know that the supply chain attack started in late November 2024 when a SpotBugs maintainer (SPTBHS_MNTNR) added their Personal Access Token (PAT) into a CI workflow. As revealed during post-incident investigations, the attacker tailored the malicious commit to target 'coinbase/agentkit.' Coinbase's CI pulled and executed the tainted version on March 14, 2025. On December 6, 2024, an attacker exploited a vulnerable 'pull_request_target' workflow to steal the maintainer's PAT via a malicious pull request from a throwaway user account (randolzflow). The stolen PAT had write access to 'reviewdog/action-setup,' allowing the attacker to override the v1 tag with a malicious commit from a fork, poisoning all consumers of v1. Also, the incident highlights fundamental problems in the chain of trust between open-source repositories, as well as GitHub Action ecosystem issues like tag mutability and poor audit logging. GitHub Actions logs, especially those from March 10-14, 2025, should be audited for signs of secrets being printed, especially base64-encoded blobs.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 03 Apr 2025 14:50:21 +0000