Threat Assessment: GitHub Actions Supply Chain Attack: The Compromise of tj-actions/changed-files

**Unit 42 analyzed a March–April 2025 multi-stage GitHub Actions supply-chain attack in which attackers compromised reviewdog/action-setup and tj-actions/changed-files (used by ~23k repos) to print CI runner memory and exfiltrate secrets and PATs via malicious commits, fork abuse, and tag overrides; the campaign included a targeted effort against Coinbase/agentkit and resulted in widespread exposure of workflow credentials, with recommended mitigations including secret rotation, action pinning, reducing workflow permissions, and auditing workflow logs.**