Compromised reviewdog GitHub Action Exposed CI Workflow Secrets
Summary
Wiz says reviewdog/action-setup@v1 was briefly compromised, injecting code that exposed CI secrets in workflow logs. Coinbase confirmed an unsuccessful attempt to compromise coinbase/agentkit; Wiz recommends auditing runs and rotating exposed secrets.
Key points
- Wiz says the reviewdog/action-setup@v1 tag pointed to malicious code on March 11, 2025, for a period of less than two hours.
- The payload was base64-encoded in install.sh and dumped CI runner memory containing workflow secrets into job logs; Wiz observed no external exfiltration.
- The compromise may have enabled the tj-actions/changed-files incident by exposing a Personal Access Token used by tj-actions/eslint-changed-files.
- Coinbase confirmed an unsuccessful attempt to compromise coinbase/agentkit; Wiz linked the activity to the same actor as a parallel supply-chain attempt.
- Wiz says only the v1 tag was affected; hash-pinned versions and other tags were not impacted, though several reviewdog actions use the affected component.
- Affected teams should inspect workflow runs from the exposure window, stop using impacted actions, remove references across branches, and rotate exposed secrets.
- Wiz recommends pinning GitHub Actions to commit hashes, auditing past runs, and restricting actions with an allow-list; the issue was assigned CVE-2025-30154.
Article Details
- Attack Vectors
- An attacker compromised the reviewdog/action-setup repository account and pointed its v1 tag to a malicious commit, which injected a base64-encoded payload into install.sh in workflows using the action.
- The payload dumped CI runner memory containing workflow secrets. In public repositories, the secrets were exposed in workflow logs as a double-encoded base64 string.
- The article reports a related compromise of tj-actions/changed-files, enabled by a compromised GitHub Personal Access Token. It also describes an unsuccessful attempt to compromise Coinbase's coinbase/agentkit.
- Defensive Notes
- Stop using affected actions and remove references to them across all repository branches.
- Rotate exposed secrets; inspect workflow runs from the relevant timeframe for the “🐶 Preparing environment ...” line and a double-encoded base64 string. Download relevant logs before deleting workflows if they may be needed for investigation.
- Pin GitHub Actions to specific commit hashes rather than version tags, use GitHub allow-listing to restrict actions, and audit past workflow runs for suspicious activity and unusual outbound network requests.
- Review repositories where CI runner logs are publicly accessible. The article recommends prioritizing explicitly referenced custom secrets for rotation; ghs_ tokens are described as short-lived and automatically expiring within 24 hours or when the workflow job completes.
MITRE ATT&CK
T1059.004 · Unix ShellThe malicious payload was inserted into the install.sh file used by the workflow and executed in affected CI workflows.T1195.002 · Compromise Software Supply ChainThe attacker placed malicious code on a fork and caused the reviewdog/action-setup v1 tag to point to a malicious commit, compromising a software supply-chain component.
CVE
People
Adnan KhanProvided a lead that helped Wiz Research identify the compromised v1 tag of reviewdog/action-setup.haya14busaIdentified and remediated the compromised user account implicated in the action-setup incident, with assistance from GitHub.San TranProvided the earliest indication of the connection between the incident and Coinbase on March 15.
Vendors
GitHubCoinbase, who have confirmed an unsuccessful attempt to compromise coinbase/agentkit. Wiz has identified GitHub identities related to the attack, indicating the attacker is active in the crypto ecosystem, French andWizthe original post is Coinbase, who have confirmed an unsuccessful attempt to compromise coinbase/agentkit. Wiz has identified GitHub identities related to the attack, indicating the attacker is active in the crypto
Products
GitHub ActionsUse this Github query to find references to the affected GitHub Actions in your organization's repositories (replace yourorg with the name of your Github organization). reviewdog/action-setupBased on a lead from Adnan Khan, Wiz Research has identified that the v1 tag of the reviewdog/action-setup Github Action was compromised in the lead up to the tj-actions incident.tj-actions/changed-filesA commit on tj-actions/changed-files from March 13th, with a payload variant that explicitly targets Coinbase repositoriestj-actions/eslint-changed-filespayload that caused affected repositories to leak their secrets in logs. By extension, tj-actions/eslint-changed-files was also compromised at the same time, as it relies ontj-actions/changed-files.