CVE-2025-30066

Name of the Vulnerable Software and Affected Versions tj-actions/changed-files versions prior to 46.0.1

Description A supply chain attack targeted the tj-actions/changed-files GitHub Action, affecting over 23,000 repositories. A threat actor compromised a bot account's personal access token to inject malicious code into the action. Between March 14 and March 15, 2025, the attacker retroactively modified version tags (including v1 through v45.0.7) to point to a malicious commit 0e58ed8. This commit introduced a function updateFeatures() that executed an obfuscated Node.js payload. The payload downloaded a Python script named memdump.py from a GitHub Gist, which scanned the memory of the Runner Worker process to extract sensitive CI/CD secrets, such as AWS access keys, GitHub Personal Access Tokens (PATs), npm tokens, and RSA private keys. These secrets were then double-encoded in base64 and printed into the GitHub Actions build logs, making them accessible to anyone with log access, particularly in public repositories.

Recommendations Update tj-actions/changed-files to version 46.0.1. Rotate all secrets, API tokens, and private keys that were used in workflows between March 14 and March 15, 2025. Review workflow logs from the affected period for suspicious double-encoded strings and decode them to identify leaked credentials. Pin GitHub Actions to specific commit SHAs instead of using version tags to prevent future supply chain compromises.