Major Breach Exposes Thousands in Reviewdog Data Leak

Executive Summary

Recently, on March 11, 2025, a major supply chain attack targeted the Reviewdog GitHub Action, compromising thousands of developer secrets and credentials. The malicious activity was detected after the v1 tag of the action was altered, allowing attackers to inject harmful code within a critical timeframe from 18:42 to 20:31 UTC. This breach exposed sensitive information as developers unknowingly utilized the compromised action in their CI/CD pipelines. The scale of the impact is significant, affecting numerous organizations relying on GitHub Actions, thereby highlighting the vulnerabilities in third-party integrations. Credentials and secrets such as API keys and access tokens were particularly at risk, emphasizing the need for robust cybersecurity measures.

 Read the full breach analysis from NHI Mgmt Group here

Key Details

Breach Timeline

• March 11, 2025: Malicious code injection detected in Reviewdog GitHub Action.
• 18:42 – 20:31 UTC: The v1 tag alteration went unnoticed, allowing the attack to unfold.
• Subsequent investigations revealed widespread use of the compromised action.

Data Compromised

• Thousands of developer secrets, including API keys and access tokens, were exposed during the breach.
• GitHub Actions users found their credentials at risk, jeopardizing security across multiple projects.

Impact Assessment

• Numerous organizations utilizing the Reviewdog action in their CI/CD pipelines were affected.
• Potential for unauthorized access to sensitive systems and resources due to exposed secrets.

Company Response

• Reviewdog initiated an immediate investigation and communicated with affected users about the breach.
• Developers were advised to rotate credentials and review security practices to mitigate risks.

Security Implications

• This incident underscores the importance of securing third-party integrations in software development.
• Organizations are urged to implement tighter security protocols and monitor for unusual activities in their CI/CD pipelines.

 If you want to learn more about how to secure NHIs including AI Agents, check our NHI Foundational Training Course.