tj-actions/changed-files GitHub Action

T0122 · Initial Access · Vulnerability in third-party CI/CD actions

Downstream workflows trusted a third-party action with access to
GITHUB_TOKEN and repository secrets.

T0111 · Resource Development · Malicious code contribution to an open-source repository

The action repository itself was modified so every consumer job
ran attacker-controlled code.

T0202 · Persistence · Inadequate CI/CD workflow permissions

Jobs that granted write tokens and did not pin the action to a
SHA amplified what the malicious step could do.

T0147 · Reconnaissance · Scan public CI/CD configurations for secrets and vulnerable actions

Public workflows listing uses: tj-actions/changed-files@v* were the
targeting list.

T0130 · Credential Access · Harvest secrets from logs

Secrets were dumped into GitHub Actions logs, which are often
readable by a wider set of identities than the job itself.

T0162 · Credential Access · Passwords in CI/CD logs

The malicious action printed PATs, npm tokens, and cloud keys into
job logs.

T0140 · Credential Access · Harvest tokens from environment variables

The action had access to the job environment, including GITHUB_TOKEN
and configured secrets.

T0193 · Collection · Sensitive information in environment variables

CI secrets lived in the job env; dumping them was enough.

T0199 · Impact · Secret leak

Stolen CI credentials were the impact, enabling follow-on publishes
and repository writes.