A security breach involving a popular GitHub Action has put thousands of repositories at risk, potentially exposing sensitive CI/CD secrets such as AWS access keys, GitHub Personal Access Tokens (PATs), npm tokens, and private RSA keys. The compromised action, tj-actions/changed-files, is used in over 23,000 GitHub projects and plays a crucial role in CI/CD pipelines by detecting and tracking file changes during pull requests.
The incident has been assigned the CVE identifier CVE-2025-30066. The attack, which occurred sometime before March 14, 2025, involved a threat actor modifying the code of the tj-actions/changed-files GitHub Action. The attackers inserted a malicious Python script designed to dump secret tokens from the GitHub Actions build logs. When executed, the malicious code caused these secrets to be logged in plain text, leaving them exposed if the build logs were publicly accessible.
In this case, the attackers updated multiple version tags of the affected GitHub Action to reference the malicious commit, thereby impacting projects that used even older versions of the action.
The Python script responsible for dumping the secrets was hosted on a GitHub Gist, which has since been removed. However, no evidence has been found to suggest that the stolen secrets were exfiltrated to attacker-controlled infrastructure.
The maintainers of tj-actions/changed-files have confirmed that the attack was traced back to a compromised GitHub personal access token (PAT) associated with the @tj-actions-bot account, which has privileged access to the repository. Once the breach was discovered, the account's password was updated, authentication was enhanced with a passkey, and the bot's permissions were restricted. Additionally, GitHub revoked the compromised PAT to mitigate further risk.
