PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-30066] GitHub Action tj-actions/changed-files supply chain attack: everything you need to know

wiz.io | incident | CVE-2025-30066 | #supply-chain | #github-actions | #ci-cd | #secrets-management | #incident | #cve-2025-30066
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Everything to know about the tj-actions/changed-files supply chain attack (CVE-2025-30066): how the compromise leaked CI secrets in public repo logs, attribution clues, and mitigation guidance.
CVE
CVE-2025-30066
Published
Collected

Related coverage

incident · aikido.dev
Get the TL;DR: tj-actions/changed-files Supply Chain Attack
The tj-actions/changed-files GitHub Action, which is currently used in over 23,000 repositories, has been compromised, leaking secrets through workflow logs and impacting thousands of CI pipelines.
vulnerability · horizon3.ai
Critical or Clickbait: GitHub Actions and Apache Tomcat RCE Vulnerabilities 2025
Explore CVE-2025-30066 and CVE-2025-24813 with real-world data from Horizon3 to assess whether these vulnerabilities are truly critical or overhyped.
incident · wiz.io
New GitHub Action supply chain attack: reviewdog/action-setup
Wiz Research details a second supply chain attack on reviewdog/action-setup (CVE-2025-30154) that may have enabled the tj-actions/changed-files compromise, with links to Coinbase-targeting activity.
incident · wiz.io
KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack
TeamPCP hijacked the Checkmarx KICS GitHub Action on March 23, serving credential-stealing malware from 35 tags; OpenVSX extensions were hit too. Audit for docs-tpcp repos and checkmarx.zone C2.
incident · wiz.io
Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack
Recapping the March 2026 Trivy compromise: TeamPCP injected malware into the scanner, trivy-action, and setup-trivy, and later fake Docker Hub images, harvesting cloud and CI/CD credentials.
incident · wiz.io
Ultralytics AI Library Hacked via GitHub for Cryptomining
Wiz details how attackers injected the XMRig cryptominer into Ultralytics PyPI releases 8.3.41/8.3.42 by exploiting GitHub Actions branch-name handling, a rare external compromise reaching PyPI.
Back