Summary Initial release

A compromise of the GitHub action tj-actions/changed-files highlights how attackers could exploit vulnerabilities in third-party actions to compromise supply chains. A compromise of the GitHub action…

Summary Improved Flexibility for multi-value inputs Performance, parsing, and testing Errors handling Logging and documentation Fixed ignoreFailures method name inconsistencies What's Changed ...

But this mystery isn't over yet, Unit 42 opines That massive GitHub supply chain attack that spilled secrets from countless projects? It traces back to a stolen token from a SpotBugs workflow - exposed way back in November, months earlier than previously suspected.…

A cascading supply chain attack on GitHub that targeted Coinbase in March has now been traced back to a single token stolen from a SpotBugs workflow, which allowed a threat actor to compromise multiple GitHub projects.

: But this mystery isn't over yet, Unit 42 opines

Summary Refactor parsing logic Add nullability contracts What's Changed in 1.1.0 Refactor to extract parsing and enforce nullability contracts in 9721edd Extract XML/SARIF parsing from SpotBugs...

YouTube video by CyberJAR

The cascading supply chain attack that initially targeted Coinbase before becoming more widespread to single out users of the "tj-actions/changed-files" GitHub Action has been traced further back to the theft of a personal access token (PAT) related to SpotBugs. "The attackers obtained initial access by taking advantage of the GitHub Actions workflow of SpotBugs, a popular open-source tool for

behavior started as early as November 2024 read more about SpotBugs Access Token Theft Identified as Root Cause of GitHub Supply Chain Attack.

A cascading supply chain attack on GitHub that targeted Coinbase in March has now been traced back to a single token stolen from a SpotBugs workflow, which allowed a threat actor to compromise multipl...

Evidence shows a SpotBugs token compromised in December 2024 was used in the March 2025 GitHub Actions supply chain attack.

https://www.securityweek.com/compromised-spotbugs-token-led-to-github-actions-supply-chain-hack/ Eyal Estrin CISSP, CCSP, CISM, CISA, CDPSE, CCSK Blog: https://security-24-7.com | Books: https://amzn.to/3xMI4Ak | https://bit.ly/4cyxaA6 Twitter: @eyalestrin | Bluesky: @eyalestrin.bsky.social

: But this mystery isn't over yet, Unit 42 opines

The massive GitHub supply chain attack that spilled secrets from 23,000 projects all started with a stolen token from a SpotBugs workflow. The attackers used this token to tamper with the popular tj-actions/changed-files GitHub Action, quietly stashing developers' secrets in log files. Who knew stealing secrets could be so... open source?