PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-30154] New GitHub Action supply chain attack: reviewdog/action-setup

wiz.io | incident | CVE-2025-30154 | #supply-chain | #github-actions | #ci-cd | #incident | #threat-research | #cve-2025-30154
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz Research details a second supply chain attack on reviewdog/action-setup (CVE-2025-30154) that may have enabled the tj-actions/changed-files compromise, with links to Coinbase-targeting activity.
CVE
CVE-2025-30154
Published
Collected

Related coverage

incident · wiz.io
GitHub Action tj-actions/changed-files supply chain attack: everything you need to know
Everything to know about the tj-actions/changed-files supply chain attack (CVE-2025-30066): how the compromise leaked CI secrets in public repo logs, attribution clues, and mitigation guidance.
incident · wiz.io
KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack
TeamPCP hijacked the Checkmarx KICS GitHub Action on March 23, serving credential-stealing malware from 35 tags; OpenVSX extensions were hit too. Audit for docs-tpcp repos and checkmarx.zone C2.
incident · wiz.io
Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack
Recapping the March 2026 Trivy compromise: TeamPCP injected malware into the scanner, trivy-action, and setup-trivy, and later fake Docker Hub images, harvesting cloud and CI/CD credentials.
incident · wiz.io
Ultralytics AI Library Hacked via GitHub for Cryptomining
Wiz details how attackers injected the XMRig cryptominer into Ultralytics PyPI releases 8.3.41/8.3.42 by exploiting GitHub Actions branch-name handling, a rare external compromise reaching PyPI.
blog · wiz.io
The (In)security Landscape of AI-Powered GitHub Actions (Part 2/2)
Part 2 of Wiz's GitHub Actions research: AI actions from OpenAI, Anthropic, and Google have config bypasses outsiders can trigger; dynamic credential files create a novel exfiltration vector.
blog · wiz.io
From Code to Pipeline: Wiz Code Now Secures Your Build Environment
Wiz Code expands to the build environment: controls for workflow triggers, job permissions, and third-party actions, addressing pipeline supply chain attacks and AI agents entering CI/CD.
Back