Popular GitHub Action tj-actions/changed-files is compromised

#1

Post by moyer » Sat, Mar 15, 2025, 12:43 AM UTC

Re: Popular GitHub Action tj-actions/changed-files is compromised

#2

Post by netvarun » Sat, Mar 15, 2025, 2:18 AM UTC

@dang: The original URL (from Step Security, the company that discovered this flaw) is a better source for this:

https://www.stepsecurity.io/blog/harden-runner-detection-tj-...

Re: Popular GitHub Action tj-actions/changed-files is compromised

#3

Post by moyer » Sat, Mar 15, 2025, 2:21 AM UTC

netvarun wrote: post #2

@dang: The original URL (from Step Security, the company that discovered this flaw) is a better source for this: https://www.stepsecurity.io/blog/harden-runner-detection-tj-...

Yeah maybe we can merge with https://news.ycombinator.com/item?id=43367987

Re: Popular GitHub Action tj-actions/changed-files is compromised

#4

Post by dang » Sat, Mar 15, 2025, 1:27 PM UTC

moyer wrote: post #3

netvarun wrote: post #2

@dang: The original URL (from Step Security, the company that discovered this flaw) is a better source for this: https://www.stepsecurity.io/blog/harden-runner-detection-tj-...

Yeah maybe we can merge with https://news.ycombinator.com/item?id=43367987

Comments moved thither. Thanks!

Re: Popular GitHub Action tj-actions/changed-files is compromised

#5

Post by v1sionSec » Sat, Mar 15, 2025, 1:55 PM UTC

[dupe]

Re: Popular GitHub Action tj-actions/changed-files is compromised

#6

Post by [deleted] » Sat, Mar 15, 2025, 2:49 PM UTC

[deleted]

Re: Popular GitHub Action tj-actions/changed-files is compromised

#7

Post by [deleted] » Sun, Mar 16, 2025, 10:49 AM UTC

[deleted]

Re: Popular GitHub Action tj-actions/changed-files is compromised

#8

Post by mgiladi » Sun, Mar 16, 2025, 11:02 AM UTC

We've recently released open-source tools that would have easily prevented this, before anything runs or added to any pipeline:

1. The maintainers could have used PRevent to immediately alert and block any PR containing malicious code, or easily configured it for detection in case of a direct push: https://github.com/apiiro/PRevent

2. Users could have used our malicious code detection ruleset to immediately detect and block it when scanning updates in all relevant CI/CD stages: https://github.com/apiiro/malicious-code-ruleset

3. For a better understanding of the detection, the malicious code falls precisely into the patterns presented in our research: https://apiiro.com/blog/guard-your-codebase-practical-steps-...