🕵️ tj-actions/changed-files compromise

The items that name it 5

• Spectrmachina/Ztrust
  repo2026-10-22It is written here as tj-actions/changed-files compromise (cited example).

  cited example

• Software supply chain security best practices for 2026
  article2026-10-21It is written here as tj-actions/changed-files compromise (March 2025): version tags repointed at a malicious commit that dumped CI secrets into workflow logs; roughly 23,000 repositories referenced it.

  March 2025

• Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners
  article2026-09-02

  GitHub Actions supply chain compromise where the same memory-read technique behind CVE-2025-8217 was used against GitHub Actions.

• GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps
  article2026-07-12

  Exposed CI/CD credentials in build logs.

• Cooldowns.dev
  article2026-05-06

  March 2025 GitHub Actions supply chain attack in which attackers re-pointed existing version tags of the tj-actions/changed-files action at a malicious commit, leaking CI secrets from over 20,000 repositories.