AI
The Credential Leak That Wasn’t the Attack
On March 14, 2025, at 4 p.m. UTC, an attacker injected code into the TJ Actions changed-files repository. That code printed CI runner secrets to logs. Four hours later, the first GitHub issue surfaced. Within days, 23,000 projects had credentials exposed. Every post-mortem focused on the leakage. The credential dump was not the attack. Palo Alto Networks researchers traced the full chain back to December 6, 2024, three months earlier, revealing a four-step attack targeting a single company.
Entry Point: Poison Pipeline Execution Against Spotbugs
The attacker’s first move targeted a vulnerable GitHub Actions workflow in the spotbugs organization, specifically a repository called sonar-find-bugs. On December 6, 2024, they forked it, added a single-line change to the MavenW file (a curl piped to bash with all output muted) and submitted a pull request. The victim’s CI triggered, checked out the forked code due to misconfiguration, and executed the malicious line. The result was a stolen personal access token belonging to a spotbugs maintainer. That PAT was still active because the owner had no idea it was gone.
Three Months of Patience, Then a Disposable User
Three months after compromising spotbugs, the attacker used the stolen PAT to sniff around. They found a second spotbugs maintainer’s PAT stored as a GitHub Actions secret, and that maintainer also controlled the review dog organization. On March 7, 2025, a Coinbase maintainer pushed a workflow using TJ Actions changed files. The attacker moved immediately. To avoid commit noise, they created a dummy GitHub user called Javak, pushed a malicious exfiltration workflow through it, let it execute, then deleted the user and the branch, within the same minute.
Shadow Commits: GitHub’s Invisible Tag Override
On GitHub, forks are branches in the same repository network. Commits pushed to a fork are accessible from the original repo. The attacker combined this with git tag overrides: push a malicious commit to a fork, then point an existing tag like v1 at that commit. Nothing lands in the original repo’s history. GitHub’s audit log does not record the tag movement. Only GitHub support can pull the ref logs. The attacker used this “shadow commits” technique to poison the review dog action setup v1 tag on March 11, 2025.
Targeting Coinbase and Burning the Field
Coinbase, a NASDAQ-traded crypto platform with a $106 billion market cap, ran a public repository called agent kit that used TJ Actions changed files. On March 13, the attacker forked TJ Actions and overrode the v39 tag via shadow commits. The malicious commit hardcoded a Coinbase name check: execute only if the runner belongs to Coinbase. On March 14 at 3:10 p.m. UTC, a Coinbase CI machine fetched v39 and ran the malicious version. At 4:37 p.m., Coinbase removed the workflow. Twenty minutes later, the attacker overrode most TJ Actions tags, exposing 23,000 repos.
Notable Quotes
this was not the attack. Aviad Hahami · ▶ 1:48
and attackers know that fact too. Aviad Hahami · ▶ 6:09
Complete silence on that end. Aviad Hahami · ▶ 23:52
But that is a nice smoking uh uh gun. Aviad Hahami · ▶ 30:01
Key Takeaways
- The 23,000-repo credential leak was fallout from a failed Coinbase-specific operation, not the primary goal.
- Shadow commits exploit GitHub’s fork network to introduce code changes with no audit trail.
- A single-line spotbugs pwn request in December 2024 started an attack chain that reached Coinbase in March 2025.
- Disposable GitHub users absorb commit noise while keeping the attacker’s real identity hidden.
- Using git tags in GitHub Actions instead of full commit SHAs enables silent tag override attacks.
About the Speaker(s)
Aviad Hahami is a security researcher and software engineer whose interests include graph theory, vulnerability research, bug bounties, chaos engineering, and systems architecture. He conducted this research during his time at Palo Alto Networks. He also DJs.