2025-03-15 · 2025-Q1
tj-actions/changed-files GitHub Actions Supply Chain Attack
Outside the model: Adjacent ecosystemAgent tooling was not the attack surface, so no layer applies.
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- Yes
- Actor
- Not applicable
Target
23,000+ GitHub repositories
Impact
Access keys, GitHub PATs, npm tokens, and private RSA keys exposed in public workflow logs
Root cause
Compromised GitHub PAT; chained via reviewdog/action-setup
CVEs
Sources
Catalog
Cite this: AgentProv incident record: tj-actions/changed-files GitHub Actions Supply Chain Attack (2025-03-15). https://agentprov.com/incidents/2025-03-15-tj-actions-changed-files-github-actions-supply-chain-attack