GitHub Actions सप्लाई चेन हमला: tj-actions/changed-files से समझौता — 23,000+ रिपॉजिटरी उजागर

Major GitHub Actions Supply Chain Compromise

A critical supply chain attack has been confirmed against the widely-used GitHub Action tj-actions/changed-files, which is referenced in over 23,000 public repositories and countless private ones. The attack, discovered on March 3, 2026, involved the injection of credential-harvesting code into the action's source that exfiltrates environment secrets during CI/CD pipeline execution.

How the Attack Works

The attacker gained access to the maintainer's GitHub account through a compromised personal access token discovered in a separate data breach. They modified the action's entrypoint.sh to include an obfuscated shell script that:

• Dumps all environment variables including GITHUB_TOKEN, AWS keys, and custom secrets
• Encodes the data in base64 and exfiltrates it via DNS TXT queries to attacker-controlled domains
• Modifies workflow logs to remove traces of the exfiltration
• Continues normal action execution to avoid detection

Affected Versions and Timeline

The malicious code was present in versions v45.0.1 through v45.0.3, published between February 27 and March 2, 2026. Any CI/CD pipeline that ran during this period using @latest, @v45, or the specific affected version tags is potentially compromised. GitHub has since removed the malicious versions and locked the repository.

Impact Assessment

KENSAI's analysis of public repository workflows reveals:

• 23,847 public repositories reference the affected action
• An estimated 41,000+ private repositories are also affected
• Exfiltrated secrets include GitHub tokens, AWS/GCP/Azure credentials, npm tokens, Docker Hub credentials, and Slack webhooks
• At least 14 confirmed secondary breaches have resulted from stolen credentials

Immediate Actions Required

Lessons for Supply Chain Security

This incident reinforces critical DevSecOps practices:

• Always pin GitHub Actions to full commit SHAs, never to tags or branches
• Use GitHub's actions/verified-creator badge as an initial trust signal
• Implement CODEOWNERS and branch protection on action repositories
• Use tools like StepSecurity's harden-runner to restrict network egress from CI/CD jobs
• Regularly audit your dependency graph for third-party actions

KENSAI CI/CD Security Scanning

KENSAI's DevSecOps module now includes automated GitHub Actions supply chain scanning. Our scanner analyzes your workflow files, identifies risky action references, and alerts on known-compromised actions in real-time. Enable CI/CD scanning in your KENSAI dashboard to protect your development pipeline.