tj-actions/changed-files leaked CI secrets

On March 14, 2025, an attacker rewrote every version tag on tj-actions/changed-files, a GitHub Action used by more than 23,000 repositories, redirecting them to a single commit that dumped CI secrets into public workflow logs. The move turned a routine helper into one of the largest CI/CD credential-exposure events on record. The action does one mundane thing: it tells a workflow which files changed in a given commit or pull request. That made it ubiquitous in CI pipelines, and most consumers pinned it by tag rather than by an immutable commit SHA, so when the tag moved, the malicious code shipped on the next run.

The malicious commit, 0e58ed8671d6b60d0890c21b07f8835ace038e67, embedded a base64-encoded shell script that fetched memdump.py from a GitHub Gist, ran it against the GitHub Actions Runner.Worker process, scanned process memory for values flagged as secrets, and printed each one to the workflow log as double-encoded base64. No external command-and-control server was needed for the broad campaign. The log itself was the exfiltration channel, and any reader of a public workflow run could harvest the result.

Researchers at Wiz, StepSecurity, and Palo Alto Networks' Unit 42 tied the incident to the earlier reviewdog/action-setup compromise three days prior. According to Unit 42, the operation began as a targeted attack on Coinbase: a token recovered from a reviewdog-poisoned workflow gave the attacker write access to tj-actions/changed-files, and once Coinbase removed the vulnerable workflow, the attacker repointed all changed-files tags to the malicious commit, broadening the impact to every downstream consumer.

Wiz reported AWS access keys, GitHub Personal Access Tokens, npm tokens, private RSA keys, and other credentials exposed in affected public repositories. CISA issued an alert on March 18 cataloging the chain as CVE-2025-30066 and CVE-2025-30154. The Register, citing StepSecurity, put the population of dependent repositories at more than 23,000; how many actually executed the malicious commit during the exposure window remains unclear.