TeamPCP Exploits Checkmarx GitHub Actions, Exposing CI/CD Secrets in Thousands of Repositories
In a significant cybersecurity incident, the hacking group known as TeamPCP has successfully compromised Checkmarx’s GitHub Actions, leading to the exposure of Continuous Integration and Continuous Deployment (CI/CD) secrets across numerous repositories. This breach underscores the escalating threats within software supply chains and the critical need for robust security measures in development workflows.
The Breach Unveiled
The attack centered on the tj-actions/changed-files GitHub Action, a tool widely utilized to monitor and retrieve altered files and directories within repositories. This action is integral to many CI/CD pipelines, facilitating efficient code management and deployment processes.
Cybersecurity researchers have identified that the attackers infiltrated the action’s codebase, retroactively updating multiple version tags to reference a malicious commit. This nefarious modification resulted in the unauthorized disclosure of CI/CD secrets within GitHub Actions build logs. Consequently, if these logs were publicly accessible, sensitive information such as AWS access keys, GitHub Personal Access Tokens (PATs), npm tokens, and private RSA keys could be exposed, posing significant security risks.
The Mechanism of the Attack
The attackers introduced a Python script into the compromised action, designed to extract secrets from the Runner Worker process. This script was hosted on a GitHub gist, a platform for sharing code snippets, which has since been removed to mitigate further exploitation.
The malicious code was traced back to an unverified commit, indicating a sophisticated level of access and manipulation by the attackers. The project maintainers revealed that the threat actors managed to compromise a GitHub personal access token (PAT) associated with the @tj-actions-bot, a bot with elevated privileges within the repository.
Scope and Impact
The tj-actions/changed-files action is employed in over 23,000 repositories, amplifying the potential impact of this breach. While there is no concrete evidence that the leaked secrets were transmitted to attacker-controlled infrastructure, the mere exposure of such sensitive information necessitates immediate and comprehensive remediation efforts.
In response to the breach, the maintainers have taken several corrective actions:
– Credential Revocation: The compromised personal access token has been revoked to prevent further unauthorized access.
– Enhanced Authentication: The account’s password has been updated, and authentication mechanisms have been upgraded to utilize passkeys, enhancing security.
– Permission Refinement: The bot’s permission levels have been adjusted to adhere to the principle of least privilege, minimizing potential attack vectors.
Users of the tj-actions/changed-files action are strongly advised to update to the latest version (46.0.1) promptly. Additionally, it is recommended to review all workflows executed between March 14 and March 15 for any unexpected outputs under the changed-files section, ensuring that no unauthorized changes have occurred.
Broader Implications
This incident is not isolated. In March 2025, a similar supply chain attack targeted the tj-actions/changed-files GitHub Action, compromising over 23,000 repositories. The attackers modified the action’s code, leading to the exposure of CI/CD secrets in build logs. This breach was assigned the CVE identifier CVE-2025-30066, with a CVSS score of 8.6, highlighting the severity of the vulnerability.
Furthermore, in September 2024, researchers identified that GitHub Actions were susceptible to typosquatting attacks. Malicious actors created repositories with names closely resembling popular GitHub Actions. If developers inadvertently referenced these malicious actions due to typographical errors, their workflows could execute unauthorized code, leading to potential security breaches.
Mitigation Strategies
To safeguard against such supply chain attacks, developers and organizations should implement the following best practices:
1. Regular Updates: Ensure that all dependencies, including GitHub Actions, are regularly updated to their latest versions to benefit from security patches and improvements.
2. Code Review: Conduct thorough reviews of third-party code and dependencies before integration into your projects to identify potential vulnerabilities.
3. Access Controls: Implement strict access controls and adhere to the principle of least privilege, granting only necessary permissions to users and bots.
4. Monitoring and Logging: Establish comprehensive monitoring and logging mechanisms to detect and respond to unauthorized activities promptly.
5. Education and Awareness: Educate development teams about the risks associated with supply chain attacks and the importance of vigilance when incorporating third-party tools and actions.
Conclusion
The exploitation of Checkmarx’s GitHub Actions by TeamPCP serves as a stark reminder of the vulnerabilities inherent in software supply chains. As development ecosystems become increasingly interconnected, the potential attack surface expands, necessitating proactive and robust security measures. By adopting best practices and fostering a culture of security awareness, organizations can mitigate the risks associated with such sophisticated attacks and protect their critical assets.
