Supply Chain Attacks Targeting GitHub Actions Increased in 2025

This report outlines a series of GitHub-focused software supply-chain attacks in which threat actors abused misconfigured GitHub Actions (for example tj-actions/changed-files, CVE-2025-30066) to steal secrets (access keys, PATs, npm tokens, private keys) and compromise downstream organizations—including an incident that affected Coinbase customers—highlighting active exploitation, the scale of impact, and the need for improved shared responsibility and defensive practices on GitHub.