tj-actions/changed-files: a compromised GitHub Action exposes secrets from thousands of pipelines

2025-03-14 · Publisher : tj-actions · Domain : Cloud & DevOps

On 14 March 2025, the GitHub Action tj-actions/changed-files (CVE-2025-30066), used by more than 23,000 repositories, is hijacked to print pipeline secrets into build logs.

### Background On 14 March 2025, the company StepSecurity detects that the GitHub Action tj-actions/changed-files, used to find files changed in a pull request, has been compromised. Attackers rewrote several version tags to point to a malicious commit. It runs a script that extracts secrets from the runner process memory and prints them into the workflow logs. The incident is assigned CVE-2025-30066. ### Key facts - More than 23,000 repositories used the action, according to StepSecurity. - Secrets were written to build logs, publicly readable in public repositories, rather than sent to a remote server. - CISA lists among exposed data: access keys, GitHub personal access tokens, npm tokens and private RSA keys. - CISA links the incident to the compromise of reviewdog/action-setup@v1 (CVE-2025-30154) a few days earlier, on 11 March. - Recommended measures: audit logs, rotate secrets, replace the action and pin actions to a full commit hash. ### Why it matters GitHub Action version tags are mutable: a single compromised maintainer account is enough to hit thousands of pipelines. The episode made SHA pinning and monitoring of runner network traffic unavoidable for CI/CD teams. For a consulting firm, it is a standard audit point of client delivery chains: where are third-party actions used, and with which secrets in scope? The case also reminds us that a CI incident can remain visible: in public repositories, the exposed logs were readable by anyone. ### Takeaway An unpinned third-party action is enough to expose the secrets of thousands of pipelines: pin, limit permissions, monitor network egress.

Tags : Sécurité, CI/CD, DevOps, Open Source