# GitHub Action tj-actions/changed-files supply chain attack: everything you need to know

Compromised tj-actions/changed-files GitHub Action dumped CI runner memory secrets into public workflow logs as double-encoded base64, leaking AWS keys, PATs, and RSA keys.

- Payout: Real-world hack
- Severity: high
- Program: tj-actions/changed-files
- Analysis by: Wiz Research
- Disclosed: 2025-03-15
- CVE: CVE-2025-30066
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
- Tags: area:cloud domain:cloud impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:high tech:github-actions technique:source-review vuln:secrets-leak

**Target:** GitHub Actions CI workflow / changed-files action
**Root cause:** Attacker compromised a GitHub PAT used by @tj-actions-bot with privileged repo access, allowing modification of existing version tags to point to malicious code on a fork.
**Steps:**
1. Attacker gains access to @tj-actions-bot PAT with privileged repo access.
2. Attacker places malicious code on a fork of the repository.
3. Attacker retags all existing versions of tj-actions/changed-files to point to the malicious code.
4. Malicious action executes in any CI workflow using it, dumping CI runner memory containing workflow secrets.
5. Secrets are emitted into workflow logs as a double-encoded base64 payload.
6. On public repos, anyone can read the logs and decode the secrets.
**How found:** Step Security first reported the compromise; Wiz Threat Research threat-hunted and observed the secret-dumping script executing, then identified dozens of impacted public repos including large enterprises by scanning workflow logs for double-encoded base64 strings.
**Exploitation:** Compromised action ran in victim CI workflows, dumped runner memory to capture secrets (AWS keys, GitHub PATs, npm tokens, RSA private keys), and printed them into workflow logs obfuscated as double-encoded base64. No external exfiltration to attacker server observed; secrets were exposed in the affected repositories' own logs.
**Escalation:** Leaked cloud keys and PATs could enable access to production cloud environments and internal source code repositories.
**Insight:** Scan CI workflow logs for double-encoded base64 blobs after any action compromise; tag-pinned actions are mutable, so hash-pinning is the only reliable defense against retagging attacks.

## Write-ups of the same bug (oldest first)
- 2025-03-15: [GitHub Action tj-actions/changed-files supply chain attack: everything you need to know](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066) — Wiz Research (this one)
- 2026-11-03: [Hardening GitHub Actions Against Outside Threats](https://bugbountylibrary.com/r/blog%3Asocket-dev-blog-hardening-github-actions-against-outside-threats) — Karlo Zanki