DEV Community
•
2026-04-29 15:05
I built chainscope: reading supply chain attacks across 6 surfaces, one slide at a time
Introduction
On 2025-03-14, the GitHub Action tj-actions/changed-files was hijacked. CVE-2025-30066. The blast radius: 23,000 repositories, 15 hours.
When a workflow says uses: tj-actions/changed-files@v44, that v44 is a tag. A tag is just a label pointing at a commit SHA, and on git, tags are rewritable. With the maintainer's GitHub Token in hand, the attacker rewrote every tag from v...