GitHub Gaffe: Popular Action Leaks Secrets, Exposing Repos to Cyber Shenanigans
The popular GitHub Action tj-actions/changed-files was compromised, leaking secrets from repositories. Attackers retroactively updated version tags to reference malicious commits, exposing sensitive data like AWS keys and GitHub tokens. While no evidence of stolen data exists, users should upgrade to the latest version to avoid further drama in their CI/CD workflow.
Hot Take:
***Who knew that a “changed-files” action on GitHub could lead to changing the security status of thousands of repositories? It seems the only thing changing faster than files on GitHub is our trust in CI/CD workflows!***
Key Points:
– The GitHub Action “tj-actions/changed-files” was compromised, affecting over 23,000 repositories.
– It leaked secrets through build logs, potentially exposing sensitive information like AWS keys and GitHub tokens.
– The incident is tagged as CVE-2025-30066 with a CVSS score of 8.6, indicating a high level of severity.
– The breach resulted from a compromised GitHub personal access token used by a bot account.
– Users are urged to update to the latest version and review workflows for unusual activity.