The latest articles on DEV Community by herbertmoroni (@herbertmoroni). https://dev.to/herbertmoroni https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F2952266%2F6af9063c-02b3-433b-9792-2efc83c63f33.png https://dev.to/herbertmoroni en herbertmoroni Tue, 18 Mar 2025 01:29:40 +0000 https://dev.to/herbertmoroni/github-action-supply-chain-attack-what-developers-need-to-know-540f https://dev.to/herbertmoroni/github-action-supply-chain-attack-what-developers-need-to-know-540f <p>A tool called <code>tj-actions/changed-files</code> that many developers use in GitHub to track file changes was hacked. Someone took control of this tool and modified it to:</p> <ol> <li>Secretly scan for passwords and secret keys in your project</li> <li>Hide these secrets in your project's logs</li> <li>Make these secrets visible to anyone who looks at public project logs</li> </ol> <p>This is called a "supply chain attack" because hackers didn't attack you directly - they attacked a tool you rely on in your development supply chain. The CVE number (CVE-2025-30066) is just an official tracking ID for this security issue.</p> <p>If you use this tool in your GitHub projects, you need to check if your passwords or secret keys were exposed and change them immediately.</p> <h2> How do I know if I'm affected? </h2> <p>You may be affected if:</p> <ul> <li>You use the <code>tj-actions/changed-files</code> action in any of your workflows</li> <li>You ran workflows with this action between March 1-15, 2025</li> <li>You store secrets or credentials in GitHub that your workflows can access</li> </ul> <p>To check:</p> <ol> <li>Look in your <code>.github/workflows</code> folder for any YAML files (.yml or .yaml)</li> <li>Search these files for <code>tj-actions/changed-files</code> </li> <li>Check your workflow logs for suspicious base64-encoded strings (they look like random characters, often ending with <code>==</code>)</li> </ol> <h2> What should I do if I'm affected? </h2> <ol> <li> <p><strong>Change all your secrets immediately</strong></p> <ul> <li>GitHub personal access tokens</li> <li>API keys for any services</li> <li>Database passwords</li> <li>Cloud provider credentials (AWS, GCP, Azure)</li> </ul> </li> <li> <p><strong>Check for unauthorized activity</strong></p> <ul> <li>Look for unexpected commits or changes to your repository</li> <li>Review access logs for your cloud resources</li> <li>Check for unusual API calls or account activity</li> </ul> </li> <li> <p><strong>Fix your workflows</strong></p> <ul> <li>Remove the compromised action</li> <li>If you need this functionality, replace with a verified alternative</li> <li>Pin all actions to specific commit hashes instead of version tags</li> </ul> </li> </ol> <h2> How can I protect myself from future supply chain attacks? </h2> <p>Even if you weren't affected, follow these practices:</p> <ol> <li> <strong>Never use version tags in GitHub Actions</strong> </li> </ol> <div class="highlight js-code-highlight"> <pre class="highlight yaml"><code> <span class="c1"># UNSAFE - can be hijacked</span> <span class="pi">-</span> <span class="na">uses</span><span class="pi">:</span> <span class="s">some-action/example@v2</span> <span class="c1"># SAFE - points to specific immutable commit</span> <span class="pi">-</span> <span class="na">uses</span><span class="pi">:</span> <span class="s">some-action/example@abc123def456...</span> </code></pre> </div> <ol> <li> <p><strong>Limit access to secrets</strong></p> <ul> <li>Only provide secrets to jobs that absolutely need them</li> <li>Use separate, limited-scope tokens for CI/CD</li> </ul> </li> <li> <p><strong>Regularly rotate credentials</strong></p> <ul> <li>Change tokens and passwords on a schedule</li> <li>Immediately rotate credentials when team members leave</li> </ul> </li> <li> <p><strong>Audit your dependencies</strong></p> <ul> <li>Periodically review which actions your workflows use</li> <li>Check for security advisories before updating</li> </ul> </li> </ol> <h2> Why do supply chain attacks matter? </h2> <p>Supply chain attacks are particularly dangerous because:</p> <ul> <li>They exploit trust in established tools</li> <li>They can affect thousands of developers at once</li> <li>They're often hard to detect until damage is done</li> </ul> <p>By being vigilant about which tools you use and how you configure them, you can significantly reduce your exposure to these attacks.</p> <p><em>This article addresses the March 2025 compromise of <code>tj-actions/changed-files</code> (CVE-2025-30066).</em></p> githubactions github cybersecurity vulnerabilities