Log in Request a demo

Significant cyber incident

tj-actions GitHub Action compromise

In March 2025 the popular GitHub Action tj-actions/changed-files was compromised.

In short

In March 2025 the popular GitHub Action tj-actions/changed-files was compromised. Its version tags were changed to point at a malicious commit, so every workflow that used it printed its secrets into the build logs. GitHub's advisory says more than 23,000 repositories were affected, and CISA added the flaw (CVE-2025-30066) to its Known Exploited Vulnerabilities catalog. It matters because a trusted build step silently exposed access keys and tokens, and public logs made them readable by anyone.

Last updated 9 October 2026

What happened

On 14 March 2025 a public issue reported that several version tags of the GitHub Action tj-actions/changed-files had been changed. GitHub’s advisory says the tags were retroactively pointed at a malicious commit, so the Action ran a script that put CI/CD secrets into workflow logs.

The advisory says the exposure lasted from 14 to 15 March 2025 and affected over 23,000 repositories. In public repositories the logs were readable by anyone.

CISA says the compromise was potentially enabled by an earlier compromise of the reviewdog/action-setup@v1 Action on 11 March 2025. Both flaws were added to CISA’s Known Exploited Vulnerabilities catalog.

Timeline

  1. 2025-03-11

    reviewdog/action-setup@v1 is compromised between 18:42 and 20:31 UTC, according to GitHub's advisory.

  2. 2025-03-14

    Version tags of tj-actions/changed-files are repointed to the malicious commit 0e58ed8. NVD and GitHub say the affected period is 14 and 15 March.

  3. 2025-03-14 20:52 UTC

    A public issue titled "Multiple tags in this action are compromised" is opened on the repository.

  4. 2025-03-15

    CVE-2025-30066 is published (NVD) and GitHub publishes its advisory.

  5. 2025-03-15 21:51 UTC

    A comment on the issue says the malicious commits were removed from all affected tags and that GitHub restored public access to the organization.

  6. 2025-03-18

    CISA publishes its alert and adds CVE-2025-30066 to the Known Exploited Vulnerabilities catalog (NVD records an add date of 2025-03-18).

  7. 2025-03-18

    The reviewdog maintainers publish a security advisory saying the reviewdog attack potentially led to the tj-actions compromise.

  8. 2025-03-19

    GitHub publishes its advisory for CVE-2025-30154 (reviewdog Actions). CISA updates its alert.

  9. 2025-03-23

    The reviewdog maintainers say a contributor's personal access token was compromised and used to overwrite the v1 tag.

  10. 2025-03-24

    CVE-2025-30154 is added to the Known Exploited Vulnerabilities catalog.

  11. 2025-03-26

    CISA revises its alert to add the reviewdog Actions and the KEV update.

  12. 2025-04-08

    Due date in the KEV catalog for CVE-2025-30066.

How the attack worked

Step 1: the upstream Action is compromised

GitHub’s advisory says reviewdog/action-setup@v1 was compromised on 11 March 2025 with code that dumps secrets to workflow logs. Other reviewdog Actions that use it were also affected. CISA says this potentially enabled the tj-actions compromise.

Step 2: the tags are moved

GitHub’s advisory says attackers retroactively changed several version tags of tj-actions/changed-files so they pointed to one malicious commit (0e58ed8). NVD says tags v1 through v45.0.7 were affected on 14 and 15 March 2025. Anyone who referenced the Action by tag, the common way, pulled the bad code on its next run.

Step 3: secrets go into the logs

The advisory says the modified Action ran a Python script. The script scanned the memory of the runner process for secrets, encoded them in base64 and wrote them to the build log. CISA says the secrets may be hidden as a double-encoded base64 payload. In repositories with public logs, anyone could read them.

What was exposed

CISA and the KEV entry name access keys (AWS access keys in the KEV text), GitHub personal access tokens, npm tokens and private RSA keys. The CVE record classifies the weakness as CWE-506, Embedded Malicious Code.

How reviewdog was reached

The reviewdog maintainers said a contributor’s personal access token was compromised and used to overwrite the v1 tag. They said the token came from an attack on another repository. They also said contributors to reviewdog action repositories were invited automatically to a team with write access, 118 members at the time.

No source used here maps the activity to MITRE ATT&CK technique ids, so none are listed.

Who says who was behind it

No public attribution. The CISA alert, the GitHub advisories, NVD and the CVE record refer to "attackers" or "a threat actor" and name no group or country. The reviewdog maintainers say they identified the contributor whose token was stolen, but do not name an actor. Sources differ on the exposure window: GitHub's advisory, NVD and the CVE record give 14 to 15 March 2025, while CISA tells organizations to check 12 March 00:00 UTC to 15 March 12:00 UTC.

Impact

GitHub's advisory says over 23,000 repositories were impacted and that the exposure ran from 14 to 15 March 2025.
Public repositories were at highest risk because their logs were readable by anyone and could already contain secrets.
CISA names access keys, GitHub personal access tokens, npm tokens and private RSA keys as examples of exposed secrets. GitHub lists API keys, cloud credentials and SSH keys as possible consequences.
NVD gives CVE-2025-30066 a CVSS 3.1 base score of 8.6 (High).
The sources used here do not give a number of stolen secrets or name victims whose secrets were abused.
The reviewdog maintainers said the stolen token came from another repository and that they found no negative impact on that repository's users.

Government and regulator response

  • 2025-03-15: A maintainer-side comment on the public issue said the malicious commits were removed from all affected tags and branches, tag protection rules were added, and GitHub restored public access to the organization.
  • 2025-03-15: GitHub published an advisory for CVE-2025-30066, with patched version 46.0.1 and guidance to review workflows, decode suspicious log output and rotate secrets.
  • 2025-03-18: CISA published its alert and added CVE-2025-30066 to the Known Exploited Vulnerabilities catalog (due date 2025-04-08). It told organizations to find affected repositories, identify exposed secrets and rotate them immediately.
  • 2025-03-18 and 2025-03-23: The reviewdog maintainers published a security advisory, disabled the automated inviter workflow, removed write access from most contributors, rotated tokens and moved their repositories to commit-SHA references.
  • 2025-03-19: GitHub published the advisory for reviewdog/action-setup (CVE-2025-30154).
  • 2025-03-24 and 2025-03-26: CVE-2025-30154 was added to the KEV catalog (due date 2025-04-14) and CISA revised its alert.

Lessons

  1. Version tags can be moved

    The attack worked because existing tags were repointed to a malicious commit. A workflow that says "use v45" can change its code without any change in your repository.

  2. Pin Actions to a full commit SHA

    GitHub's documentation says pinning to a full-length commit SHA is currently the only way to use an Action as an immutable release. Check that the SHA belongs to the Action's own repository, not a fork.

  3. CI logs are an exposure surface

    The script put secrets into build logs. In public repositories those logs were readable by anyone, so a log is not a safe place for secrets.

  4. One upstream compromise can reach another

    CISA says the reviewdog compromise potentially enabled the tj-actions one. Dependencies of your dependencies matter.

  5. Maintainer access is part of your risk

    The reviewdog maintainers described an auto-invite flow giving write access to 118 members, and a stolen personal token. Tight write access and rotating tokens reduce this risk.

  6. Rotate first, investigate in parallel

    CISA's advice was to treat identified secrets as compromised and rotate them immediately, without waiting for proof of misuse.

What to check in your own organization

  1. List every Action you use

    Search all workflow files in your organization for third-party Actions, including tj-actions/changed-files and the reviewdog Actions CISA lists.

  2. Check for the bad commit and window

    Look in run logs for commit 0e58ed8 or runs in the windows GitHub (14 to 15 March) and CISA (12 March to 15 March 12:00 UTC) give. For reviewdog, check 11 March 18:42 to 20:31 UTC.

  3. Look for encoded blobs in logs

    CISA says secrets may appear as a double-encoded base64 payload in the log. Decode suspicious output as GitHub's advisory describes.

  4. Rotate exposed secrets

    Rotate access keys, GitHub tokens, npm tokens and private keys that were available to affected workflows.

  5. Pin Actions to full commit SHAs

    Replace tag references with full-length SHAs and consider the repository or organization policy that requires pinning.

  6. Review who can push tags

    Check who has write access to repositories and tags you own, and review personal access tokens and automatic invitations.

  7. Check log visibility

    Review which repositories have public workflow logs and what secrets their workflows can reach.

Questions

What was CVE-2025-30066?

The identifier for the compromise of the GitHub Action tj-actions/changed-files. NVD says it allows remote attackers to discover secrets by reading actions logs.

How many repositories were affected?

GitHub's advisory says over 23,000 repositories were impacted.

When did it happen?

GitHub's advisory, NVD and the CVE record say 14 and 15 March 2025. CISA advises checking from 12 March 00:00 UTC to 15 March 12:00 UTC. Sources differ.

Was it linked to the reviewdog compromise?

CISA says the tj-actions compromise was potentially enabled by the compromise of reviewdog/action-setup@v1 (CVE-2025-30154) around the same time.

Is it in CISA's KEV catalog?

Yes. CISA added CVE-2025-30066 on 2025-03-18 and CVE-2025-30154 later in March 2025.

Who was behind it?

There is no public attribution in the sources used here.

How do I protect myself?

Update to version 46.0.1 or later, rotate any exposed secrets, and pin Actions to full-length commit SHAs, as CISA and GitHub advise.

In our research

  1. tj-actions compromise: how to catch it in your CI October 2026
  2. A contractor repo and cloud keys: CISA’s lessons October 2026
  3. Nx Console and GitHub: dev tools as an entry path October 2026
  4. How a Trivy Compromise Reached LiteLLM Releases October 2026
  5. Cyber incidents of 2026: lessons from official reports October 2026
  6. Bybit theft: what it teaches about supplier access October 2026

Sources

  1. Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154) CISA
  2. tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs (GHSA-mrrh-fwg8-r2c3) GitHub Advisory Database
  3. Multiple Reviewdog actions were compromised during a specific time period (GHSA-qmg3-hpqr-gqvc) GitHub Advisory Database
  4. CVE-2025-30066 (NVD record via API) NIST National Vulnerability Database
  5. CVE-2025-30066 (CVE record) CVE Program (MITRE)
  6. Known Exploited Vulnerabilities Catalog (JSON feed) CISA
  7. Multiple tags in this action are compromised (issue 2463) tj-actions/changed-files on GitHub
  8. Comments on issue 2463 tj-actions/changed-files on GitHub
  9. README security alert tj-actions/changed-files on GitHub
  10. Security Advisory: Supply Chain Attack on reviewdog GitHub Actions (issue 2079) reviewdog on GitHub
  11. Comments on reviewdog issue 2079 reviewdog on GitHub
  12. Security hardening for GitHub Actions GitHub Docs

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Supply chain attack

A supply chain attack reaches its target by exploiting weaknesses in the products or services the target depends on.

Read more