In March 2025 an attacker compromised tj-actions/changed-files and rewrote its release tags to point...
In March 2025 an attacker compromised tj-actions/changed-files and rewrote its
release tags to point at malicious code. The injected code dumped runner memory
into workflow logs, which on a public repository means printing your secrets
where anyone can read them. Around 23,000 repositories depended on that action,
most of them through a mutable tag like @v45.
GitHub Action tags point to malicious commits, exposing CI/CD credentials; 15 second-action tags also compromised.
Pinning Actions to a commit SHA is a one-line change. The value is in three habits most guides skip: re-resolving the SHA…
Recent supply chain attacks use compromised GitHub credentials to push malicious GitHub Actions workflows that steal CI/CD…
Your CI workflow is the softest target in your repo. It runs automatically, it has a GITHUB_TOKEN...
Anyone who can file an issue on your GitHub repo can now leak your CI/CD secrets. No code, no...
Been thinking about writing this one for a while. Supply chain attacks against CI/CD pipelines have...
