Compromised GitHub Action Exposed Secrets in Public Repository Logs
Summary
A compromised tj-actions/changed-files action ran malicious code in affected workflows, exposing secrets in logs. Wiz identified dozens of impacted public repositories; maintainers reverted the malicious commits, but exposed credentials may still require rotation.
Key points
- The compromise affected all versions after attackers changed version tags; hash-pinned users were not affected unless they adopted an impacted hash during the exploitation window.
- The malicious payload dumped CI runner memory containing workflow secrets into action logs, encoded as a double-encoded base64 string.
- Wiz observed the payload executing and identified dozens of affected public repositories, including repositories operated by large enterprises.
- Exposed secrets included AWS access keys, GitHub personal access tokens, npm tokens and private RSA keys. The article reports no observed external exfiltration to attacker-controlled servers.
- The malicious commits and hosted script were removed, mitigating future exploitation, though cached actions and previously exposed secrets remained concerns.
- Maintainers later said a GitHub personal access token used by a privileged bot was compromised; the investigation was ongoing.
- Recommended response includes stopping use of the action, checking workflow logs for the payload, rotating exposed secrets and pinning GitHub Actions to commit hashes.
Article Details
- Victim Organization
- tj-actions
- Incident Type
- Software supply-chain compromise of GitHub Actions, resulting in workflow secrets being exposed in logs
- Data Types Exposed
- AWS access keys
- GitHub Personal Access Tokens
- npm tokens
- Private RSA keys
- Other workflow secrets
- Operational Impact
- The compromised action executed malicious code in affected CI workflows and dumped runner memory containing workflow secrets into logs. Wiz reported identifying dozens of affected public repositories. No external exfiltration to an attacker-controlled server was observed. The malicious commits were reverted and the gist hosting the script was deleted, but cached actions and previously exposed secrets remained a risk.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
CVE
People
Vendors
GitHubMarch 17, 2025 update: Wiz Threat Research has identified another compromised GitHub Action called reviewdog/action-setup, that may have contributed to the compromise of tj-actions/changed-files.WizMarch 17, 2025 update: Wiz Threat Research has identified another compromised GitHub Action called reviewdog/action-setup, that may have contributed to the compromise of tj-actions/changed-files.
Products
GitHub ActionsCheck for any GitHub Actions that include the affected compromised component and ran during the relevant timeframe.reviewdog/action-setupMarch 17, 2025 update: Wiz Threat Research has identified another compromised GitHub Action called reviewdog/action-setup, that may have contributed to the compromise of tj-actions/changed-files.tj-actions/changed-filesMarch 17, 2025 update: Wiz Threat Research has identified another compromised GitHub Action called reviewdog/action-setup, that may have contributed to the compromise of tj-actions/changed-files.Wiz CodeWiz Code customers with GitHub connector can use the created controls on affected code repositories to detect the presence of compromised actions. In addition, the vulnerability finding was created to identify anyWiz DefendWiz Defend customers with GitHub audit logs enabled are protected against potential secondary malicious activities facilitated by the abuse of any compromised credentials, such as workflow log deletion or mergesWiz SensorWiz Sensor customers with Sensor deployed on CI workloads can detect malicious activity related to this attack, such as process memory dump and script deployment (see screenshot below demonstrating a detection of James