Skip to content

Back to the catalog

GitHub Action tj-actions/changed-files supply chain attack: what you need to know | Endor Labs
endorlabs.comarticle

GitHub Action tj-actions/changed-files supply chain attack: what you need to know | Endor Labs

Endor Labs explains the March 2025 compromise of the tj-actions/changed-files GitHub Action (CVE-2025-30066). Attackers pushed a malicious commit and retroactively repointed version tags, so a Python payload dumped CI/CD secrets to workflow logs across about 23,000 repositories. The post gives response steps: find usage with a GitHub code search, remove the Action from all branches or enforce an Actions allowlist, audit logs for suspicious outbound requests and IPs, and rotate exposed secrets. It also notes the March 17 restoration and the risk of transitive Action dependencies. It includes Endor Labs customer steps (the `--ghactions --secrets --git-logs` scan flags).

TL;DR Endor Labs' incident guidance on the tj-actions/changed-files tag-rewrite compromise (CVE-2025-30066): scope exposure, remove the Action, audit logs, rotate secrets.
Open original ↗
Document

What it is

CVE-2025-30066 is the March 2025 compromise of the tj-actions/changed-files GitHub Action, used in over 23,000 repositories. Attackers modified the Action's code and retroactively repointed multiple version tags to the malicious commit. The Action then ran a Python script that dumps CI/CD secrets. The page says all versions were affected.

How it works

The payload writes secrets to stdout, so they land in workflow logs. Any repo whose CI runner logs are public therefore exposed its secrets to anyone who could read them.

Preconditions / Affected

  • Public GitHub repositories with GitHub Actions enabled that used the Action.
  • Enterprise orgs with both public and private repos are at risk if those repos share CI/CD secrets, such as artifact or container registry credentials. A leak from a public repo can then compromise the shared registries.
  • Endor Labs said it had no evidence of downstream package or container compromise at the time of writing.

What to do

Find usage in your org (replace [YOURORG]):

https://github.com/search?q=org%3A[YOURORG]+uses%3A+tj-actions%2F&type=code

Then:

  1. Remove the Action from every branch, not just main. Alternatively, set a GitHub Actions allowlist so it cannot run even if it remains in the code.
  2. Check logs for suspicious outbound network requests. Start with repos whose runner logs are public.
  3. Disable and rotate every secret stored alongside affected repos, including secrets shared with private repos.

Endor Labs CI/CLI customers should add these flags to their existing scan configuration:

--ghactions --secrets --git-logs

Caveats

  • The code search misses transitive usage, where another Action or workflow imports tj-actions. Searching your own code is not enough.
  • GitHub restored the repository on March 17, 2025, and no version contains the malicious code now. Before the restoration, removal broke pipelines that depended on it unless a cached copy was in use.
  • The page links to guidance on treating Actions as dependencies, but does not reproduce it.

CVEs named here

Technologies named here

Related in Supply Chain