March 24th, 2025

A recent GitHub Actions supply chain attack primarily targeted Coinbase, a cryptocurrency exchange. The attack involved injecting malicious code into the `reviewdog/action-setup@v1` GitHub Action, which led to the dumping of CI/CD secrets and authentication tokens in GitHub Actions logs. Threat actors then used a stolen Personal Access Token to push a malicious commit to another GitHub Action, `tj-actions/changed-files`, again dumping secrets. Although this malicious commit specifically targeted Coinbase projects, including their `coinbase/agent kit`, and attackers gained write access to the repository, Coinbase reported that the attack was ultimately unsuccessful and did not impact their assets. While 23,000 projects used the compromised action, only 218 repositories were affected.