GitHub Action supply chain attack exposed secrets in 218 repos

The compromise of GitHub Action tj-actions/changed-files has impacted only a small percentage of the 23,000 projects using it, with it estimated that only 218 repositories exposed secrets due to the supply chain attack. Despite the small number, the potential security repercussions are still significant as some repositories are very popular and could be used in further supply chain attacks. That said, owners of exposed repositories must take immediate action to rotate their secrets before attackers get the chance to exploit the leakage. GitHub Action' tj-actions/changed-files' was compromised by attackers who added a malicious commit on March 14, 2025, to dump CI/CD secrets from the Runner Worker process to the repository. If workflow logs were set to be publicly accessible, those secrets could be accessed and read by anyone. Subsequent investigation showed that the attack was likely made possible via another supply chain attack targeting the "reviewdog/action-setup@v1" GitHub Action. That breach may have compromised a GitHub personal access token (PAT) used by a bot that had the privilege to perform changes on 'tj-actions/changed-files.' According to data shared by Endor Labs that monitored the exposure of secrets resulting from said supply chain attack, the impact of the incident appears to be limited yet still significant. During the timeframe of the exposure, between March 14, 04:00 PM UTC, and March 15, 02:00 PM UTC, 5,416 repositories across 4,072 distinct organization...