GitHub Action hack likely led to another in cascading supply chain attack

A supply-chain compromise of the reviewdog/action-setup@v1 GitHub Action injected a base64-encoded payload into install.sh that wrote CI/CD secrets into workflow logs; researchers believe this led to theft of a tj-actions bot Personal Access Token and secret exposure affecting about 23,000 repositories. Affected projects are advised to remove the compromised actions, delete workflow logs, rotate secrets, pin Actions to commit hashes, and use allow-listing to prevent recurrence.