GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment (Updated 4/2)
Summary: An attacker compromised the tj-actions/changed-files GitHub action, used by over 23,000 repositories, by pushing a malicious commit (0e58ed8) disguised as renovate[bot] and repointing the repository's git tags to it, causing the action to dump CI runner memory and secrets into workflow logs. Unit 42 traced the entry point to the reviewdog/action-setup action, reached through tj-actions/eslint-changed-files, and found the attack began in November 2024 with an initial targeting of Coinbase's open source agentkit project, though the attacker did not use Coinbase secrets or publish packages.
Bottom line: A single compromised dependency reached the CI/CD pipelines of thousands of repositories, and the attacker's access came from a token stolen through a chained action rather than a direct breach of the affected projects. The Coinbase attempt failed to yield secrets or packages, but the same actor then scaled to the wider tj-actions and reviewdog compromise.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026