GitHub Actions, 23,000 repositories: when the pipeline exposes the keys

On 14 and 15 March 2025 the tj-actions/changed-files component, used by more than 23,000 repositories, was altered to print CI/CD secrets into logs; the first target was a Coinbase project. The analysis: costs without theft, the pipeline as a supplier, liability, aggregation and questions for renewals.

Archive: reconstruction written in November 2026

Topic of the month, March 2025 · by cybercoverinsurance

On 14 and 15 March 2025 tj-actions/changed-files, a GitHub Actions component used by more than 23,000 repositories, was altered to print into build logs the secrets of the projects using it: cloud keys, access tokens, private keys. A few days earlier another component, reviewdog/action-setup, had been compromised. Later analysis pointed to an open source project of Coinbase as the first target.

For cyber underwriters the case is useful even though it produced no large known claims. It shows how a single component of the build chain can expose the credentials of thousands of organisations within hours, and it raises three questions: what happens when secrets leak but nobody uses them, who is liable if tampered code comes out of the pipeline, and how to measure aggregation that runs through developer tools.

What is known

The component. tj-actions/changed-files is a GitHub Action that detects which files changed in a project. According to StepSecurity it was used by more than 23,000 repositories. The altered code ran a script that read CI/CD secrets (API keys, passwords, tokens) from the memory of the build process and wrote them to the logs. In projects with public logs, the secrets were readable by anyone. Wiz found dozens of public repositories with exposed secrets, including valid AWS keys, GitHub and npm tokens and private RSA keys (The Register).

The cause. The attack went through a personal access token tied to the automated account @tj-actions-bot. GitHub said it could not determine how the token was compromised. The component is tracked as CVE-2025-30066, scored 8.6 (The Register). CISA added it to its catalogue of exploited vulnerabilities, with an alert dated 18 March (Cybersecurity Dive).

The chain. On 11 March reviewdog/action-setup (CVE-2025-30154) had been compromised, for about two hours and across about 1,500 repositories according to Wiz. The tj-actions compromise lasted about 22 hours and touched about 14,000 repositories. Endor Labs counted about 218 repositories that actually exposed secrets, mostly GitHub tokens that expire when the job ends (Cybersecurity Dive).

The target. According to Palo Alto Networks Unit 42, later confirmed by Wiz, the attacker first went after the public CI/CD workflow of agentkit, an open source project of Coinbase. On 14 March it had obtained a token with write access to the repository, but could not reach Coinbase's secrets or publish packages. After Coinbase reacted, it moved to the broad attack on all versions of tj-actions (Cybersecurity Dive).

What is not known. No data theft or fraud traced to the exposed secrets has been made public. There is no evidence that secrets from public repositories were sent to external servers (The Register). How many organisations incurred clean-up costs, and how much, is not known.

An exposed secret is already an incident

No known theft, many certain costs. The advice from GitHub, Wiz and Sysdig was the same: treat projects as compromised, rotate all secrets, check workflows run on 14 and 15 March (The Register, Cybersecurity Dive). For a company with dozens of pipelines, that means days of log review, key rotation and checks on cloud access.

The policy must say whether it responds. Many cyber policies cover response costs after a security event, but the definition varies: unauthorised access, suspected breach, compromised credentials. A secret printed in a public log, with no evidence of use, sits on the boundary. For underwriters, it is worth clarifying in advance whether investigation and rotation costs are covered even without confirmed access.

A secret's value depends on what it opens. A GitHub token that expires when the job ends is worth little. A valid AWS key opens the production cloud environment. The severity of the incident, and of any claim, depends on the secret's permissions more than on the compromised component.

The pipeline is a supplier

Third-party code runs with the insured's keys. A GitHub Action is third-party code, downloaded on each run, that works with the project's secrets. It is the same pattern as Polymarket in 2026 and Bybit in 2025: external code running at the most sensitive point. In the pipeline, the sensitive point is the publishing and cloud access keys.

Referencing by version does not protect. The attacker moved all of tj-actions' version tags to the malicious code. Anyone referencing the component by version received the new code without noticing. GitHub recommends pinning each Action to the full commit identifier (The Register). It is a simple, verifiable control, and not widely used.

Automated accounts are privileged identities. The way in was a bot account's token. These accounts often have broad permissions, no multi-factor authentication and tokens that never expire. After the incident tj-actions reduced permissions, added passkeys and required signed commits (The Register).

Liability and aggregation

The bigger risk is the code that goes out, not the code that comes in. In this case the attacker looked for secrets. With a write token it could have inserted code into the packages a project publishes. For a software company, a tampered package shipped to customers is a third-party liability claim, with possible effects on many downstream victims.

Aggregation runs through tools, not sectors. The same Actions are used by banks, software companies, insurers and public administrations. A portfolio diversified by sector can be concentrated on the same development tools. The data does not show up in traditional questionnaires.

One event, many timelines. The compromise lasted hours, but exposed secrets can be used weeks later if nobody rotates them. A single-cause event can produce claims spread over time, with aggregation questions similar to those of Cleo and MOVEit.

What to bring to renewals

Impact for insurersMedium

A GitHub Actions component used by more than 23,000 repositories exposed CI/CD secrets for about 22 hours, with no large known claims but widespread clean-up costs.

On the portfolio side, the useful question is how many insureds use GitHub Actions or similar tools with unpinned third-party components. For software companies, liability exposure towards customers for tampered code should be assessed together with their own cyber exposure.