# New GitHub Action supply chain attack: reviewdog/action-setup

Attacker repointed reviewdog/action-setup@v1 to a malicious commit that dumped CI runner memory, leaking workflow secrets in logs and likely enabling the tj-actions PAT compromise.

- Payout: Real-world hack
- Severity: critical
- Program: reviewdog
- Credited: Wiz Research
- Disclosed: 2025-03-17
- CVE: CVE-2025-30154
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-new-github-action-supply-chain-attack-reviewdog-action-setup
- Tags: domain:oss impact:data-leak impact:integrity kind:incident platform:threat-intel sev:critical tech:github-actions technique:chained technique:source-review vuln:secrets-leak

**Target:** GitHub Action reviewdog/action-setup@v1 install.sh
**Root cause:** Attacker gained access to a contributor account and force-pushed the v1 tag to a malicious commit on a fork, injecting base64-encoded code into install.sh that dumps runner memory.
**Steps:**
1. Identify workflows referencing `reviewdog/action-setup@v1` (or dependent reviewdog actions) via GitHub code search
2. Check workflow runs during March 11 18:42-20:31 UTC window
3. Expand the `Run reviewdog/action-setup@v1` step and look for `🐶 Preparing environment ...`
4. Search for a double-encoded base64 string in that step's output
5. Decode to recover dumped secrets from runner memory
**How found:** Lead from Adnan Khan; Wiz correlated the reviewdog v1 tag pointing to a malicious commit in the same window as the tj-actions PAT compromise, and noted tj-actions/eslint-changed-files uses reviewdog/action-setup@v1.
**Exploitation:** Malicious install.sh dumped CI runner process memory containing workflow secrets; on public repos the double-base64-encoded secrets appeared in workflow logs, exposing them to anyone. No external exfiltration server observed.
**Escalation:** Chained: reviewdog compromise likely yielded the tj-actions-bot PAT, enabling compromise of tj-actions/changed-files, which then leaked secrets across many downstream repositories; a payload variant explicitly targeted Coinbase repositories.
**Insight:** Mutable version tags on GitHub Actions are a supply-chain pivot: a single tag force-push on a low-profile setup action can yield PATs that unlock far more popular downstream actions. Audit transitive action dependencies, not just direct ones.