GitHub Action Attack: 23,000 Repositories in Hot Water!
The tj-actions/changed-files GitHub Action was compromised, leading to CI/CD secrets getting leaked like a clumsy magician’s tricks. With over 23,000 repositories affected, it’s a supply chain attack that turned secure workflows into a secret-sharing soiree! GitHub quickly pulled the plug, but not before the code had its moment in the spotlight.
Hot Take:
GitHub Actions just made a cameo in the latest cybersecurity drama, showcasing how even your beloved automation tools can moonlight as double agents. If your project was using tj-actions/changed-files, it’s time to fire it and hire a new bodyguard, because this one just spilled all your secrets!
Key Points:
- GitHub Action tj-actions/changed-files was compromised, leaking secrets from repositories.
- Over 23,000 repositories were potentially affected by this supply chain attack.
- The attack involved modifying the action’s code and updating version tags to a malicious commit.
- StepSecurity and Wiz Threat Research confirmed no external exfiltration of secrets.
- GitHub has removed the compromised action and advises updating to version 46.0.1.
Already a member? Log in here