The fallout from the malicious tj-actions/changed-files is still being investigated. It is fortuitous that this malicious commit was identified fairly quickly, as further compromise of major OSS components and projects could lead to a kind of chain reaction.
- https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
- https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/
#infosec #cybersecurity
2 Comments
jerry@infosec.exchange · 2 pts · 1y
@harrysintonen@infosec.exchange the second and third order impacts of this could get interesting
harrysintonen@infosec.exchange · 2 pts · 1y
@jerry It largely depends on how well the initial impact is cleaned up. I'm hoping we won't see a ton of backdoors in various components next.