GitHub supply chain attack spills secrets from 23K projects

It's not such a happy Monday for defenders wiping the sleep from their eyes only to deal with the latest supply chain attack. StepSecurity disclosed a compromise of the popular GitHub Action tj-actions/changed-files, which works to detect file changes in open source projects, noting that more than 23,000 GitHub repositories currently use the automation project's code. The security shop said attackers compromised the project at some unknown point before March 14 (March 12, according to Sysdig) and altered its code so the Action would leak secrets from a project's developer workflow into build logs. In cases where these logs are publicly available, such as public repositories, it means that any project using tj-actions/changed-files would be leaking secrets for all to see. The risk to private repos is thought to be much lower, but maintainers should still consider their projects compromised. The GitHub Action was tampered with to inject a Node.js function containing base64-encoded instructions to run a Python script that leaked a project's continuous integration / continuous delivery (CI/CD) secrets from the Runner Worker process, according to Sysdig. Such secrets can include API keys, passwords, access tokens, and more, so it will come as some relief to admins that there is no evidence that any of the secrets leaked from public repos were exfiltrated to any outside server. Similar malicious code could be found in another project – Flank – Sysdig noted, and in this case, the da...