Loading story…
A GitHub Actions supply-chain attack compromised widely used actions including tj-actions/changed-files and components in the reviewdog ecosystem after attackers abused insecure workflow patterns to steal maintainer personal access tokens and move trusted tags to malicious code. Investigators traced the intrusion to a malicious pull request against the SpotBugs ecosystem using the dangerous pull_request_target trigger, which exposed a maintainer token that was later used to implant another workflow, steal additional tokens, and overwrite action tags. The malicious action chain leaked CI/CD secrets and environment variables by dumping runner memory into workflow logs, affecting downstream repositories at scale and including a targeted attempt involving Coinbase, which said the incident did not damage its assets.
Separate research showed that GitHub Actions integrations with Azure via OpenID Connect can also be undermined when federated identity credentials trust unsafe subject identifiers such as unprotected branches, tags, environments, or especially pull_request, allowing contributors to obtain Azure access tokens under weak configurations. The analysis found that even reusable workflows constrained with job_workflow_ref can still expose cloud access if the workflow permits caller-controlled code execution through mechanisms such as script injection or Terraform plan behavior. Together, the findings show that GitHub Actions trust boundaries can fail both in software supply chains and cloud federation unless organizations pin actions to commit SHAs, protect refs, minimize token permissions, validate reusable workflows, and enforce least-privilege access to secrets and cloud roles.
Trace attribution and downstream blast radius.
12 events from the most recent confirmed update back to the earliest known activity.
On March 21, 2025, Palo Alto Networks Unit 42 published an assessment describing the multi-stage GitHub Actions supply-chain attack affecting tj-actions/changed-files and reviewdog-related actions.
By March 20, 2025, maintainers of tj-actions and reviewdog had applied mitigations in response to the supply-chain attack.
On March 18, 2025, the reviewdog maintainer published a security advisory about the incident, formally disclosing compromise activity affecting reviewdog actions.
StepSecurity researchers detected suspicious activity and reported the compromise of tj-actions/changed-files on March 14, 2025. The malicious payload dumped CI/CD runner memory and exposed environment variables and secrets in workflow logs.
A maintainer deleted coinbase/agentkit's changelog.yml workflow on March 14, 2025 after it was identified as referencing v39 of tj-actions/changed-files.
coinbase/agentkit executed a malicious tj-actions/changed-files SHA on March 14, 2025 in a workflow running with write-all permissions. Investigators also reported the attacker obtained a write-capable GitHub token for coinbase/agentkit at 15:10 UTC that day.
The same iLrmKCu86tjwp8 account forked reviewdog/action-typos on 2025-03-11 17:21:52 UTC and pushed 15 commits with payload variations, indicating broader compromise activity in the reviewdog ecosystem.
A GitHub account named iLrmKCu86tjwp8 forked reviewdog/action-setup on 2025-03-11 17:06:12 UTC and pushed 13 commits with payload variations, establishing malicious infrastructure used in the supply-chain attack.
After inserting the malicious code, the attacker overrode existing git tags in tj-actions/changed-files so they pointed to the malicious commit, expanding impact to workflows that referenced tags rather than pinned SHAs.
Between March 10 and March 14, 2025, an attacker pushed malicious commit 0e58ed8 to tj-actions/changed-files using a GitHub token with write permissions. The commit was disguised as if created by renovate[bot] and merged through an auto-merge workflow.
Investigators observed attacker-linked activity connected to Coinbase through forks of coinbase/onchainkit, coinbase/agentkit, and coinbase/x402 created on March 12–13, 2025, suggesting reconnaissance or preparation for targeted abuse.
An April 2, 2025 update attributed reviewdog's compromise to a leaked personal access token belonging to a reviewdog maintainer, identified in the report as RD_MNTNR.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 52 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
binarysecurity.no
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The widely used GitHub Action **`tj-actions/changed-files`** was compromised after an attacker gained write access to the repository and retargeted release tags to a malicious orphaned commit, causing workflows pinned to tags rather than immutable SHAs to run attacker-controlled code. The backdoor downloaded and executed a remote payload that scraped decrypted GitHub Actions secrets from process memory and printed them into workflow logs, exposing repositories that executed the action and creating acute risk for public projects where logs were openly accessible. The incident was detected after anomalous outbound network activity was observed, and the maintainer removed the malicious changes soon afterward. Follow-on analysis found the blast radius was substantial because the action was referenced across roughly **23,000 repositories** and many workflows were not pinned to a full commit hash. GitGuardian reported that among workflows executed during the compromise window, hundreds showed signs of exploitation and **603 secrets** were exposed in logs, including temporary GitHub tokens, DockerHub credentials, AWS keys, GitHub personal access tokens, Jira tokens, and cloud.gov credentials. Organizations using the action were urged to review workflow runs from March 14 onward, delete affected logs, rotate any exposed credentials, audit dependencies and commits, and pin third-party GitHub Actions to full commit SHAs to reduce future supply-chain risk.
Jun 29, 2026
Threat actors compromised the popular GitHub Actions repositories `actions-cool/issues-helper` and `actions-cool/maintain-one-comment` by moving version tags to imposter commits outside the normal commit history, causing workflows that referenced those tags to fetch and run malicious code. Researchers said the payload downloaded the **Bun** JavaScript runtime, read memory from the GitHub Actions `Runner.Worker` process to recover decrypted secrets, and exfiltrated the data over HTTPS to the attacker-controlled domain `t.m-kosche[.]com`; workflows pinned to a known-good full commit SHA were not affected. GitHub later disabled access to the repository for a terms-of-service violation, while StepSecurity added the action to its Compromised Actions Policy and blocked the exfiltration domain through Harden-Runner. The incident highlights a broader GitHub Actions supply-chain risk in which CI/CD trust can be subverted through mutable references and weak integrity controls. Separate research showed that a modified Maven wrapper in a pull request could achieve code execution on GitHub-hosted runners and, if merged, later expose release secrets such as Maven publishing credentials and GPG material, underscoring the need for checksum validation on wrapper scripts and immutable pinning to trusted commit SHAs for third-party actions. StepSecurity also linked the same exfiltration infrastructure to the recent **Mini Shai-Hulud** activity targeting npm packages in the `@antv` ecosystem, suggesting the GitHub Actions compromise may be part of a wider supply-chain campaign.
Jun 29, 2026
Palo Alto Networks demonstrated how a compromised GitHub Action could become a self-propagating software supply-chain worm by traversing the GitHub Actions dependency tree. A malicious action can access workflow-runner secrets—including automatically issued `GITHUB_TOKEN` credentials—and use writable branches, mutable tags, or overly permissive personal access tokens to alter repositories that consume or maintain dependent actions. The researchers identified repojacking as a viable initial-access route and disclosed an example chain involving `papeloto/action-zip`, Veracode, and Hangfire. The scenario highlights OWASP's `CICD-SEC-05` risk of insufficient pipeline-based access controls (PBAC): CI/CD identities and workflows must receive only the permissions required for a specific job. Organizations should minimize `GITHUB_TOKEN` and PAT scopes, protect branches and release tags, pin third-party actions to immutable commit SHAs, restrict runner outbound network access, and review dependency relationships and secret exposure in workflows to prevent a compromised action from modifying downstream repositories.
Sep 3, 2026