A widely used GitHub Action has been compromised in a supply chain attack aimed at exposing secrets within continuous integration and continuous delivery (CI/CD) workflows.
The affected GitHub Action, known as ‘tj-actions/changed-files,’ is a key component for monitoring file and directory changes in CI/CD pipelines. With over 23,000 repositories utilizing this action, the breach has raised significant concerns in the developer community.
According to security firm StepSecurity, the attack began on March 14, when a threat actor altered the Changed-files code, embedding a malicious Python script designed to exfiltrate CI/CD secrets through build logs.
“If workflow logs are publicly accessible—such as in public repositories—anyone could potentially read these logs and extract exposed secrets,” StepSecurity warned.
While several public repositories were found leaking sensitive information in build logs, no direct evidence of exfiltration has been discovered so far.
Malicious Code and Security Response
The attackers modified most existing Changed-files version tags to point to a malicious commit, leading to the assignment of CVE-2025-30066 to track this security incident.
Software supply chain security experts at Endor Labs have also analyzed the breach but found no indication that downstream open-source libraries or container images were directly affected.
“The attacker was likely not searching for secrets in public repositories, as those are already exposed. Instead, they were likely attempting to infiltrate the software supply chain by targeting open-source libraries, binaries, and artifacts created using this action,” Endor Labs explained.
This means thousands of open-source packages that rely on the compromised GitHub Action for CI/CD processes may have been impacted.
Enterprise Risk and GitHub’s Response
Security researchers highlight that both private and public repositories could be at risk, particularly if they share CI/CD pipeline secrets for artifact or container registries.
On March 15, GitHub removed the tj-actions/changed-files action, only to reinstate it later that day after eliminating the malicious commit from all associated tags and branches.
Tj-actions developers and security firms have since published guidance on identifying potential indicators of compromise (IoCs) and best practices for incident response.
Speculation Around the Attack
There is ongoing debate regarding the sophistication of the attack. Some experts speculate it was the work of an unsophisticated threat actor, while others believe it was an effort to highlight security risks in widely used GitHub Actions.
Interestingly, a security researcher noted that a theoretical attack scenario targeting tj-actions/changed-files had been outlined in a blog post a year prior to this incident.
How to Protect Your CI/CD Pipelines
Developers and organizations using GitHub Actions are advised to:
- Check repositories for IoCs related to the compromised action.
- Rotate any potentially exposed secrets stored in CI/CD environments.
- Review dependencies to ensure no malicious commits remain in use.
- Implement strict access controls to CI/CD secrets to minimize exposure risk.
As the security community continues to assess the fallout from this incident, it serves as a stark reminder of the vulnerabilities within the software supply chain and the importance of proactive security measures.
