How it unfolded

1. 1

   An upstream dependency is backdoored first

   Attackers compromised reviewdog/action-setup (CVE-2025-30154), a dependency of the tj-actions release process, obtaining a GitHub token with write permissions in the process.

2. 2

   A commit is disguised as a routine bot contribution

   Using that write token, the attacker pushed a commit to tj-actions/changed-files crafted to look like an automated renovate[bot] update, and it was folded into a legitimate pull request that auto-merged.

3. 3

   Release tags are retroactively repointed

   The attacker then force-moved multiple existing version tags to point at the malicious commit. Every consuming workflow pinning by tag — not by commit SHA — silently ran the tampered action on its very next run.

4. 4

   The payload dumps runner memory into public logs

   The injected code printed the CI runner's process memory straight into the workflow's own log output, a public artifact on public repositories, exposing access keys, PATs, npm tokens, and private RSA keys.

5. 5

   23,000+ repositories are exposed in one sweep

   Because tj-actions/changed-files was so widely consumed, the tag retarget alone reached every downstream repository's next workflow run; researchers traced the original intended target to Coinbase's agentkit repository.