topic Re: GitHub Actions Supply Chain Compromise - tj-actions in Threats

GitHub Actions Supply Chain Compromise - tj-actions

akkem — Sat, 15 Mar 2025 17:45:34 GMT

tj-actions/changed-files, has been compromised with a payload that appears to attempt to dump secrets, impacting thousands of CI pipelines.

https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised

https://www.upwind.io/feed/github-actions-supply-chain-compromise-tj-actions-changed-files-action

Re: GitHub Actions Supply Chain Compromise - tj-actions

akkem — Mon, 17 Mar 2025 23:50:03 GMT

We always recommend using a checksum or digest before deploying anything to a system. If you have verified the SHA value during installation to ensure you're using the correct version of tj-actions, then you are not compromised. Otherwise, regardless of the tag, all versions are vulnerable, as tags can be modified to push the same vulnerable code.

Re: GitHub Actions Supply Chain Compromise - tj-actions

Kyaw_Myo_Oo — Tue, 18 Mar 2025 12:04:19 GMT

This is very informative. Thank you for sharing your time and experience with us in this forum @akkem.

Re: GitHub Actions Supply Chain Compromise - tj-actions

Caute_cautim — Fri, 21 Mar 2025 03:06:24 GMT

Hi All

A sophisticated cascading supply chain attack has compromised multiple GitHub Actions, exposing critical CI/CD secrets across tens of thousands of repositories. The attack, which originally targeted the widely used “tj-actions/changed-files” utility, is now believed to have originated from an earlier breach of the “reviewdog/action-setup@v1” GitHub Action, according to a report.

Source: Cryptogram - Bruce Schneier

CISA confirmed the vulnerability has been patched in version 46.0.1.

Given that the utility is used by more than 23,000 GitHub repositories, the scale of potential impact has raised significant alarm throughout the developer community.

Regards

Caute_Cautim

Re: GitHub Actions Supply Chain Compromise - tj-actions

akkem — Mon, 24 Mar 2025 12:42:31 GMT

Supply chain and OAuth attacks are on the rise in GitHub, threat campaign targeting over 8,000 repositories with the goal of luring developers into granting full repository access. Mitiga’s researchers explain an active GitHub compromise and large-scale phishing campaign, along with providing recommendations for threat hunting and mitigation.
https://www.mitiga.io/blog/uncovering-hidden-threats-hunting-non-human-identities-in-github?utm_source=Marketo&utm_medium=Email&utm_campaign=MonthlyNewsletter&mkt_tok=NDIyLURKUC0xNjEAAAGZZv92weMEvYsFdrKojktdAFzWR24xakr8gAQ4JFXwD4D1oaHd4FeyKsRbNbGfYGuoX_FY9pI0sro_xCvPNeT1ye-KSXEvisvdHk8s1SdD