Supply Chain Attack Targets GitHub Repositories and Secrets

Attackers subverted a widely used tool for GitHub, potentially giving them access to software development environment secrets from thousands of private code repositories. Stolen secrets could include API keys and authentication tokens, potentially allowing attackers to infiltrate other widely used tools, experts warned.

See Also: Your Guide to Threat Hunting for Effective Risk Management

GitHub, based on the Git version control system, is used by developers to store, manage and share code and underpins numerous software development and collaboration environments.

Security researchers said that on Wednesday, an attacker injected malicious code into a tool for GitHub Actions, which is designed to automate integration and continuous delivery – aka CI/CD – workflows in GitHub.

The malicious code was injected into changed-files, a set of popular tj-actions for GitHub Actions, which is “designed to detect which files have changed in a pull request or commit,” said Tomer Filiba, CTO of cloud security firm Sweet, in a Sunday blog post. “It enables workflows to execute tasks conditionally based on file modifications, such as running specific tests or triggering deployments. Due to its usefulness, the action is widely adopted in open-source and enterprise repositories.”

The malicious activity appears to have been designed as a supply-chain attack. “The attacker was likely not looking for secrets in public repositories – they are already public,” said Dimitri Stiliadis, CTO at software supply chain security firm Endor Labs, in a Saturday blog post. “They were likely looking to compromise the software supply chain for other open source libraries, binaries and artifacts created with this. Any public repository that creates packages or containers as part of a CI pipeline could have been impacted.”

Software firm StepSecurity, which builds a software supply chain security platform for GitHub Actions, discovered the attack, first issuing a warning Friday. “We are actively investigating a critical security incident involving the tj-actions/changed-files GitHub Action,” it said in its initial blog post.

“The attackers modified the action’s code and retroactively updated multiple version tags to reference the malicious commit,” StepSecurity CEO Varun Sharma later summarized.

The flaw underlying the incident is tracked as CVE-2025-30066.

The attack involved injecting into the action a malicious function written in Node.js, containing instructions that “download Python code designed to scan the memory of the GitHub Runner for credentials,” said Michael Clark, director of threat research at Sysdig, in a Saturday blog post. GitHub Runner refers to GitHub-hosted virtual machines designed to run jobs.

After the malicious Python script runs, “the results are output and stored within the GitHub Action build logs,” Clark said. “The attackers must have access to these logs in order to extract the secrets.”

Attack and Response: Timeline in UTC

• March 12 00:00: Attack begins after attackers compromise tj-actions/changed-files via a malicious code commit, to make it dump “CI/CD secrets from the Runner Worker process,” StepSecurity said;
• March 15 02:00: StepSecurity first reports “multiple public repositories have leaked secrets in build logs,” which if publicly exposed would mean anyone could steal them;
• March 15 12:00: GitHub removes tj-actions/changed-files, making it no longer usable, and issues a security alert warning that all versions of the action from v1 to 45.0.7 were compromised and could allow “remote attackers to extract secrets by reading actions logs”;
• March 15 22:00: GitHub restores tj-actions/changed-files action with all malicious code expunged.

Any organization with a public repository that used the compromised version of tj-actions/changed-files – available from Wednesday through Friday, as detailed in the timeline is at “high risk” of their secrets having been exposed via public logs, Sysdig’s Clark said.

Private repositories may also have exposed secrets. “Although the exposure risk is slightly lower, any private repository using the affected action should treat its secrets as potentially compromised,” he said.

“You should perform a code search across your repositories to discover all instances of the tj-actions/changed-files action,” StepSecurity’s Sharma said. “If you discover any secrets in GitHub Actions workflow run logs, rotate them immediately.”