The GitHub Action supply chain compromise, which impacted over 23,000 repositories, is now linked to a previously undisclosed attack against another entity last week. The initial attack, involving tj-actions/changed files (CVE-2025-30066), took place between March 14-15 and resulted in leaked secrets, including GitHub Tokens, due to a compromised personal access token. A related attack on reviewdog/action-setup/v1 (CVE-2025-30154) occurred on March 11, affecting around 1,500 repositories. The tj-actions/changed files breach had a wider scope, impacting 14,000 repositories for 22 hours.
The Cybersecurity and Infrastructure Security Agency (CISA) has added the tj-actions/changed files vulnerability to its known exploited vulnerabilities catalog and urged organizations to report any suspicious activity. GitHub has advised users to review workflows from March 14-15, revoke, and rotate secrets to mitigate any impact.
Researchers suggest that for long-term security, organizations should implement strict pipeline-based access controls.
