Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-30066] GitHub Action tj-actions/changed-files supply chain attack: everything you need to know

wiz.io | incident | CVE-2025-30066 | #supply-chain | #github-actions | #ci-cd | #secrets-management | #incident | #cve-2025-30066

Summary

Everything to know about the tj-actions/changed-files supply chain attack (CVE-2025-30066): how the compromise leaked CI secrets in public repo logs, attribution clues, and mitigation guidance.
Published
Collected

original ↗

Related coverage

  1. Get the TL;DR: tj-actions/changed-files Supply Chain Attack (aikido.dev)
  2. New GitHub Action supply chain attack: reviewdog/action-setup (wiz.io)
  3. Ultralytics AI Library Hacked via GitHub for Cryptomining (wiz.io)
  4. KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack (wiz.io)
  5. Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack (wiz.io)
  6. Supply chain attack on lottie-player: everything you need to know (wiz.io)

back