CVE-2025-30066

What is tj-actions/changed-files?

tj-actions/changed-files is a popular GitHub Actions workflow component used to detect which files changed in a pull request or push event. It is referenced by over 23,000 public repositories and countless private repositories to automate CI/CD pipeline decisions based on which files were modified. GitHub Actions workflows run in a CI/CD context with access to repository secrets — AWS credentials, API keys, GitHub PATs, npm tokens, and deployment keys — making supply chain attacks on widely used Actions extremely high-impact.

Overview

CVE-2025-30066 is an embedded malicious code vulnerability (CWE-506) in the tj-actions/changed-files GitHub Action. An attacker compromised the tj-actions GitHub account on March 14, 2025, and injected a malicious shell payload into the Action's code by repointing version tags across all historical releases. Any CI/CD workflow that ran tj-actions/changed-files@v<any version> after the compromise executed the payload, which dumped all exposed CI/CD secrets (AWS credentials, GitHub PATs, npm tokens, RSA keys) to the workflow's public or private logs. Coinbase appears to have been the initial target; the broader attack affected thousands of repositories globally.

Affected Versions

Workflows using @vN or @main tags were affected. Pinned workflows using @<full commit SHA> were not affected if the commit predated the compromise.

Technical Details

The attacker gained control of the tj-actions GitHub account (likely through a compromised personal access token associated with the maintainer's account, possibly obtained via the upstream reviewdog compromise — see CVE-2025-30154). Once in control:

1. Tag rewriting: The attacker forced-updated all existing version tags (v1 through v45) to point to a new malicious commit containing an injected script, rather than the legitimate historical commits.
2. Malicious payload: The injected script ran cat /proc/1/environ and printed base64-encoded environment variables — which in a GitHub Actions context include all secrets.* values — to the workflow run log.
3. Log exfiltration: Attacker-controlled servers scraped public workflow logs for the dumped secrets. Private workflow logs are also accessible to anyone with repository access.

Secrets commonly exposed:

• AWS IAM access keys and secret keys
• GitHub Personal Access Tokens (with repo/admin scopes)
• npm publish tokens
• Docker Hub credentials
• SSH private keys for deployment
• Stripe, Twilio, and other API service keys

Workflows using SHA pinning were safe: uses: tj-actions/changed-files@a0585ff01f97bad (a real SHA) would not have been affected since the commit itself was not modified.

Discovery

Coinbase security teams identified anomalous log output in their CI/CD pipelines on March 14–15, 2025, reported the issue, and initiated the broader investigation that revealed the attack's scope.

Exploitation Context

The attack directly targeted Coinbase's CI/CD pipeline, with the broader deployment appearing to have been a "spray" to collect credentials from the thousands of repositories referencing the Action. The same threat actor subsequently compromised reviewdog/action-setup (CVE-2025-30154) — a GitHub Action that tj-actions/changed-files itself depended upon — indicating a methodical supply chain escalation.

Wiz Research estimated ~23,000 public repositories were affected, with an unknown number of private repositories. The incident became a landmark case study in GitHub Actions supply chain security.

Remediation

1. Pin all GitHub Actions to full commit SHAs — use uses: tj-actions/changed-files@<full-sha> instead of @v45 or @main. This is the only reliable defense against tag rewriting attacks.
2. Immediately rotate all credentials that may have been exposed in workflows running the compromised Action between March 14–15, 2025: AWS keys, GitHub PATs, npm tokens, SSH keys, and any other secrets.
3. Audit CI/CD logs for base64-encoded strings in unexpected positions — this is the signature of the dump payload.
4. Review and minimize secrets in GitHub Actions workflows — secrets should have minimum required scopes and short expiry.
5. Follow CISA's mitigation instructions at the alert URL above for specific remediation steps.
6. Enable GitHub's push_policy: required workflow approval for PRs from external contributors, and audit which actions your workflows invoke.