tj-actions/changed-files GitHub Action compromise leaks CI secrets
On March 14, 2025, an attacker repointed version tags of the tj-actions/changed-files GitHub Action to a malicious commit that dumped CI runner memory and printed secrets into workflow logs, which are readable by anyone on public repositories (CVE-2025-30066). CISA said the compromise was potentially enabled by an earlier compromise of reviewdog/action-setup@v1 (CVE-2025-30154), which tj-actions workflows ran with a personal access token. Unit 42 found the campaign began as a targeted attack on Coinbase before widening.
- Victim
- Multiple: repositories using tj-actions/changed-files
- Industry
- Technology
- Country
- Global
- Intrusion began
- Mar 14, 2025
- First disclosed
- Mar 14, 2025
- Actor
- Unattributed
- Initial access
- Supply chain
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A personal access token reachable from a third-party action was enough to rewrite a dependency used across thousands of pipelines. Pinning actions to commit SHAs and replacing long-lived tokens with short-lived, scoped credentials limits both the entry and the leak.
Go deeper on SWI
- Technique: Secrets in repositories and CI
Sources
- Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154), CISA, Mar 18, 2025
- GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment, Unit 42, Palo Alto Networks, Mar 21, 2025
- GitHub Action tj-actions/changed-files supply chain attack, Wiz, Mar 15, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Shai-Hulud 2.0 npm worm exposes credentials in 25,000+ repositories 2025 · Supply chain
- Shai-Hulud self-replicating npm worm steals maintainer tokens 2025 · Supply chain
- Nx s1ngularity npm compromise harvests developer secrets with AI CLIs 2025 · Supply chain
- Mimecast Microsoft 365 connection certificate stolen by SolarWinds actor 2021 · Supply chain
Cite this record
SWI Community Team. (2026). tj-actions/changed-files GitHub Action compromise leaks CI secrets. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-tj-actions-changed-files-ci-secrets/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.