GitHub Supply Chain Attack Exposes CI/CD Secrets in Thousands of Repositories

A sophisticated supply chain attack has compromised multiple GitHub Actions, leading to the exposure of CI/CD secrets across over 23,000 repositories. The attack targeted the ‘tj-actions/changed-files’ tool, which was compromised due to an earlier breach of ‘reviewdog/action-setup@v1.’ Security researchers from Wiz identified that attackers injected malicious code into these utilities, allowing them to extract sensitive credentials such as access keys, GitHub Personal Access Tokens (PATs), and private RSA keys.

The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed the vulnerability (CVE-2025-30066), which has since been patched in version 46.0.1. However, the cascading nature of the attack means that multiple GitHub Actions may still be affected. The breach highlights the risks associated with third-party dependencies in CI/CD pipelines. Security experts recommend pinning GitHub Actions to specific commit hashes and using allow-listing features to prevent unauthorized code execution. Organizations are urged to check their repositories for affected actions and rotate exposed credentials immediately to mitigate risks.

This incident underscores the growing threat of supply chain attacks targeting development infrastructure and the importance of proactive security measures to protect software development workflows.