March 24th, 2025

Cyber Mornings Daily · Mar 24, 2025 · 14m

A recent GitHub Actions supply chain attack primarily targeted Coinbase, a cryptocurrency exchange. The attack involved injecting malicious code into the `reviewdog/action-setup@v1` GitHub Action, which led to the dumping of CI/CD secrets and authentication tokens in GitHub Actions logs. Threat actors then used a stolen Personal Access Token to push a malicious commit to another GitHub Action, `tj-actions/changed-files`, again dumping secrets. Although this malicious commit specifically targeted Coinbase projects, including their `coinbase/agent kit`, and attackers gained write access to the…