CISA's March 2025 alert covers two linked compromises: tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154). The reviewdog compromise may have enabled the tj-actions one. Secrets such as access keys, tokens and private keys in workflows that ran the bad code were at risk.
The facts, with dates
From CISA's alert, published 18 March 2025 and revised 26 March:
- Malicious tj-actions/changed-files versions were live from 12 March 2025 00:00 UTC to 15 March 2025 12:00 UTC.
- The reviewdog compromise window ran from 11 March 2025, 18:42 to 20:31 UTC.
- tj-actions was patched in v46.0.1.
- Both CVEs were added to CISA's Known Exploited Vulnerabilities Catalog on 26 March 2025.
- Other reviewdog actions may also have been affected, including action-shellcheck and action-staticcheck.
CISA says the compromise allowed disclosure of secrets including valid access keys, GitHub personal access tokens, npm tokens and private RSA keys, and that the secrets could appear as a double encoded base64 payload.
Why a changed-files action had access to secrets at all
A step in a workflow runs with the job's environment. If a job has a deploy key in its environment, every action in that job can read it, including a small helper that lists changed files. The helper never needed the key, but nothing stopped it from seeing it.
How to work out your own exposure
- Search all repositories for use of tj-actions/changed-files or the reviewdog actions.
- Check run history for jobs that ran within the windows above.
- For each such run, list the secrets that job could read, not only the ones the step used.
- Rotate all of them and treat them as compromised, as CISA advises.
- Look at provider logs for use of those credentials since the window opened.
- Report incidents to CISA through its published channels if you are in scope.
What to change afterwards
- Pin actions to commit SHAs. See why tags are not a pin.
- Split jobs so that helpers run in a job with no secrets, and deploy steps run in a job that executes only your own code.
- Set the default token permission to read only and raise it per job.
- Prefer short-lived cloud credentials issued per run.
A note on timing
The two windows are short, a few hours for reviewdog and about three and a half days for tj-actions. Short windows are easy to dismiss, but a workflow that ran once inside one is enough. Do not judge exposure by how often a job runs. Judge it by whether any run overlaps the dates, and by what that run could read. Keep the run list and your findings as a record, even if the answer is none.
Quick check
Were only public repositories at risk?
CISA's alert singles out public repositories whose workflows ran the malicious commit. Private repositories that ran it should still treat their secrets as exposed.
Is updating to v46.0.1 enough?
It stops further exposure from that version, but secrets that leaked during the window still need rotation.
Sources
Last reviewed: 19 October 2026.
