---
id: 7047
title: "[CVE-2025-30066] GitHub Action tj-actions/changed-files supply chain attack: everything you need to know"
cve: CVE-2025-30066
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066"
published_at: "2025-03-15T16:19:08Z"
tags: ["supply-chain", "github-actions", "ci-cd", "secrets-management", "incident", "cve-2025-30066"]
phying_url: "https://phying.com/item/7047"
lang: en
---

# [CVE-2025-30066] GitHub Action tj-actions/changed-files supply chain attack: everything you need to know

## Summary

Everything to know about the tj-actions/changed-files supply chain attack (CVE-2025-30066): how the compromise leaked CI secrets in public repo logs, attribution clues, and mitigation guidance.

## Intelligence Metadata

- **Sources:** wiz.io
- **CVE:** CVE-2025-30066
- **Published:** 2025-03-15T16:19:08Z
- **Original:** https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
- **Phying News:** https://phying.com/item/7047