In April 2025, Palo Alto Networks Unit 42 traced the tj-actions/changed-files supply chain attack back to its start: a Personal Access Token (PAT) stolen from the SpotBugs open source project in December 2024. On 28 November 2024, a SpotBugs maintainer changed a workflow in the spotbugs/sonar-findbugs repository to use their own PAT, to work around a CI problem. That workflow used the pull_request_target trigger, which gives workflows started from forks access to the repository's secrets. On 6 December, an attacker opened a malicious pull request that leaked the PAT. Three months later, on 11 March 2025, the attacker used it to invite a throwaway account into spotbugs/spotbugs, pushed a malicious workflow and stole a second PAT belonging to a maintainer who also worked on reviewdog. That token was used to poison reviewdog/action-setup, which in turn leaked the token used to compromise tj-actions/changed-files.
Key takeaways
- A SpotBugs maintainer added their own PAT to a workflow that used the pull_request_target trigger, exposing it to pull requests from forks.
- An attacker stole the PAT with a malicious pull request on 6 December 2024 and did not use it until March 2025.
- With it, the attacker added a disposable member to spotbugs/spotbugs, ran a malicious workflow and stole a reviewdog maintainer's PAT.
- That second PAT had access to reviewdog/action-setup, starting the chain that led to tj-actions/changed-files and a targeted attempt on Coinbase.
- The identity lesson: a personal token stored as a CI secret in an exposed workflow is effectively published, and one token can open many projects.
At a glance
| Organisations | SpotBugs (spotbugs/sonar-findbugs and spotbugs/spotbugs repositories); downstream reviewdog, tj-actions and their users; Coinbase (apparent target) |
|---|---|
| When | First PAT stolen 6 December 2024; used 11 March 2025; root cause published by Unit 42 on 2 April 2025 |
| Attacker | Unattributed; the same actor as the reviewdog and tj-actions compromises, according to Unit 42 |
| Entry point | A malicious pull request exploiting a pull_request_target workflow in spotbugs/sonar-findbugs |
| Identities abused | A SpotBugs maintainer's PAT stored as a workflow secret; a reviewdog maintainer's PAT stored as a secret in spotbugs/spotbugs; disposable GitHub accounts |
| Impact | Start of a supply chain chain that exposed secrets in 218 repositories, according to BleepingComputer |
| Category | NHI. Incident class: confirmed NHI breach (CI/CD secret leaked through a pull_request_target workflow) |
What happened
Unit 42's first analysis in March 2025 linked tj-actions/changed-files to reviewdog/action-setup but left open how reviewdog was compromised. Its 2 April update answered that: "The attackers obtained initial access by taking advantage of the GitHub Actions workflow of SpotBugs, a popular open-source tool for static analysis of bugs in code. This enabled the attackers to move laterally between SpotBugs repositories, until obtaining access to reviewdog."
The weak point was a workflow change. On 28 November 2024, a SpotBugs maintainer "modified one of the spotbugs/sonar-findbugs workflows to use their own PAT, as they were having technical difficulties in a part of their CI/CD process." That workflow used pull_request_target, "a GitHub Actions workflow trigger that allows workflows running from forks to access secrets, which may lead to a poisoned pipeline execution attack (PPE)," Unit 42 explained. On 6 December, the attacker submitted a pull request from a disposable account that modified the repository's mvnw file, which the CI then ran, leaking the PAT.
On 11 March 2025, the attacker used that PAT to invite another disposable account, jurkaofavak, to spotbugs/spotbugs; two minutes later that account pushed a branch with a malicious workflow. "The attacker used this malicious workflow to leak all spotbugs/spotbugs secrets, which included RD_MNTNR's PAT," Unit 42 wrote, referring to a reviewdog maintainer. That PAT had access to reviewdog/action-setup, and the chain continued from there. Unit 42 noted "a three-month gap between when the attackers leaked SPTBGS_MNTNR's PAT and when they abused it," and suggested the attacker may have been waiting for a high-value target: Coinbase's agentkit workflow began using tj-actions/changed-files on 7 March. BleepingComputer reported that the tj-actions commit ultimately exposed secrets for 218 repositories.
Timeline
| Date | Event |
|---|---|
| 28 November 2024 | A SpotBugs maintainer adds their PAT to a spotbugs/sonar-findbugs workflow. |
| 6 December 2024 | The attacker's malicious pull request leaks the PAT through the pull_request_target workflow. |
| 11 March 2025 | The attacker invites a disposable account to spotbugs/spotbugs, steals a reviewdog maintainer's PAT and poisons reviewdog/action-setup. |
| 14 March 2025 | The tj-actions/changed-files compromise is detected. |
| 2 April 2025 | Unit 42 publishes the SpotBugs root cause. |
| 3 April 2025 | BleepingComputer reports the findings. |
How it happened: the identity attack path
- Personal token in CI. A maintainer stored their own PAT as a secret in a workflow triggered by pull_request_target.
- Token leaked by pull request. A malicious pull request from a fork ran code that exposed the PAT.
- Dormant access. The attacker held the token for three months.
- Privilege used to add a member. The PAT invited a disposable account with write access to spotbugs/spotbugs.
- Second token stolen. A malicious workflow leaked all repository secrets, including a reviewdog maintainer's PAT, which opened the next project.
Impact
- Direct: two maintainer PATs and the secrets of spotbugs/spotbugs leaked.
- Downstream: reviewdog/action-setup and tj-actions/changed-files compromised; secrets exposed in 218 repositories, according to BleepingComputer.
- Targeted: Coinbase's agentkit workflow consumed a malicious tag; Coinbase said no damage resulted, Unit 42 reported.
What this means for NHI governance
The whole chain began with a convenience fix: a maintainer used their own long-lived token because something in CI was not working. That token then sat in a workflow that ran code from strangers' pull requests. Personal tokens used as machine credentials are a classic NHI problem: they carry a person's full access across every project, they are rarely rotated, and nobody else knows they are in use. The three-month gap before the attacker used it shows that leaked tokens remain dangerous long after the leak.
Projects should use dedicated, narrowly scoped machine identities for CI instead of personal tokens, avoid pull_request_target for workflows that touch secrets, and rotate any token that has been exposed to untrusted code. See our CI/CD Pipeline Identity Security Guide and NHI Ownership Guide.
Recommendations
- Do not use personal tokens in CI. Use GitHub App tokens or OIDC with the minimum scope. See our NHI Authentication Guide.
- Avoid pull_request_target with secrets. Never check out or run fork code in a workflow that can read secrets. See the CI/CD Pipeline Identity Security Guide.
- Rotate tokens after exposure, even without signs of misuse. This attacker waited three months. See the Leaked Credential Response Playbook.
- Alert on new members and unusual branches. A new member pushing a workflow two minutes after joining is a clear signal. See the ITDR Guide.
- Know which tokens cross projects. Maintainers of several projects should use separate, scoped tokens for each.
Frequently asked questions
What was the root cause of the tj-actions supply chain attack?
Unit 42 traced it to a SpotBugs maintainer's PAT, leaked in December 2024 through a pull_request_target workflow. The attacker used it in March 2025 to steal a reviewdog maintainer's token, which led to reviewdog and then tj-actions.
What is a pull_request_target attack?
The pull_request_target trigger runs workflows with access to the repository's secrets even for pull requests from forks. If the workflow runs code from the pull request, an attacker can steal those secrets.
Why did the attacker wait three months?
Unit 42 does not know. It suggested the attacker may have been waiting for a high-value target, noting that Coinbase's agentkit started using tj-actions/changed-files on 7 March 2025.
Related NHI Mgmt Group resources
reviewdog Action Compromise 2025 · tj-actions/changed-files Compromise 2025 · CI/CD Pipeline Identity Security Guide · NHI Authentication Guide · NHI Ownership Guide
How NHI Mgmt Group can help
Personal tokens quietly become machine credentials in many CI pipelines. We help teams find them, replace them with scoped machine identities and lock down workflows that run untrusted code. See our NHI and AI agent security training.
References
- Palo Alto Networks Unit 42: GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident (2 April 2025)
- BleepingComputer: Recent GitHub supply chain attack traced to leaked SpotBugs token (3 April 2025)
- The Register: Stolen SpotBugs tokens sparked the massive GitHub attack (7 April 2025)