A devastating supply chain attack has been confirmed by the Cybersecurity and Infrastructure Security Agency (CISA), exposing sensitive credentials across over 23,000 GitHub repositories. The attack, which originated from a breach of the 'reviewdog/action-setup@v1' GitHub Action, has compromised multiple GitHub Actions, including the widely used 'tj-actions/changed-files' utility.

The initial compromise of 'tj-actions/changed-files', designated as CVE-2025-30066, was discovered last week when researchers found malicious code injected into the tool. CISA has officially acknowledged the issue, noting that "This supply chain compromise allows for information disclosure of secrets including, but not limited to, valid access keys, GitHub Personal Access Tokens (PATs), npm tokens, and private RSA keys."

The attack chain, as revealed by security researchers at Wiz, involved attackers compromising the 'reviewdog/action-setup@v1' GitHub Action, injecting code designed to dump CI/CD secrets to log files. Since 'tj-actions/eslint-changed-files' utilizes this reviewdog component, the initial breach created a pathway for attackers to steal a personal access token (PAT) used by the 'tj-actions' system.

The attack methodology was particularly sophisticated, involving the insertion of a base64-encoded payload into an install script, causing secrets from affected CI workflows to be exposed in workflow logs. In repositories with public logs, these exposed secrets would be readily available to malicious actors, creating a significant security vulnerability across the GitHub ecosystem.

The full extent of the compromise remains under investigation, with several other potentially impacted actions from the same developer, including 'reviewdog/action-shellcheck', 'reviewdog/action-composite-template', 'reviewdog/action-staticcheck', 'reviewdog/action-ast-grep', and 'reviewdog/action-typos', still being assessed.

While GitHub and reviewdog maintainers have implemented fixes, Wiz warns that if any compromised actions remain in use, a repeat attack targeting 'tj-actions/changed-files' could still occur — especially if exposed secrets are not rotated. Industry experts are particularly concerned about the method of compromise within the Reviewdog project, which maintains a large contributor base and accepts new members via automated invites, potentially creating security weaknesses in their permission structure.

For organizations potentially affected by this breach, security teams should immediately check for any references to 'reviewdog/action-setup@v1' in their repositories. The presence of double-encoded base64 payloads in workflow logs would confirm that secrets have been leaked. In such cases, all references to affected actions should be removed across branches, workflow logs should be deleted, and any potentially exposed credentials must be rotated immediately.

To mitigate similar risks in the future, security specialists are recommending several preventative measures. Rather than using version tags when implementing GitHub Actions, developers should pin their actions to specific commit hashes, which are immutable and cannot be modified after creation. Additionally, organizations should leverage GitHub's allow-listing feature to restrict unauthorized actions from running in their environments.

The incident underscores a growing trend of supply chain attacks targeting development tools and infrastructure. As organizations increasingly rely on third-party components and actions to streamline their development processes, the potential impact of such compromises continues to grow. A single breach in a widely used tool can quickly cascade across thousands of projects, highlighting the interconnected nature of the modern development ecosystem.