---
id: 7046
title: "[CVE-2025-30154] New GitHub Action supply chain attack: reviewdog/action-setup"
cve: CVE-2025-30154
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup"
published_at: "2025-03-17T21:28:56Z"
tags: ["supply-chain", "github-actions", "ci-cd", "incident", "threat-research", "cve-2025-30154"]
phying_url: "https://phying.com/item/7046"
lang: en
---

# [CVE-2025-30154] New GitHub Action supply chain attack: reviewdog/action-setup

## Summary

Wiz Research details a second supply chain attack on reviewdog/action-setup (CVE-2025-30154) that may have enabled the tj-actions/changed-files compromise, with links to Coinbase-targeting activity.

## Intelligence Metadata

- **Sources:** wiz.io
- **CVE:** CVE-2025-30154
- **Published:** 2025-03-17T21:28:56Z
- **Original:** https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup
- **Phying News:** https://phying.com/item/7046