Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-30154] New GitHub Action supply chain attack: reviewdog/action-setup

wiz.io | incident | CVE-2025-30154 | #supply-chain | #github-actions | #ci-cd | #incident | #threat-research | #cve-2025-30154

Summary

Wiz Research details a second supply chain attack on reviewdog/action-setup (CVE-2025-30154) that may have enabled the tj-actions/changed-files compromise, with links to Coinbase-targeting activity.
Published
Collected

original ↗

Related coverage

  1. GitHub Action tj-actions/changed-files supply chain attack: everything you need to know (wiz.io)
  2. Ultralytics AI Library Hacked via GitHub for Cryptomining (wiz.io)
  3. KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack (wiz.io)
  4. Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack (wiz.io)
  5. Supply chain attack on lottie-player: everything you need to know (wiz.io)
  6. How JFrog’s AI-Research Bot Found OSS CI/CD Vulnerabilities to Prevent Shai Hulud 3.0 (jfrog.com)

back