We have recently been informed by Wiz Research of a supply chain attack targeting the reviewdog/action-setup@v1 GitHub Action. This attack potentially led to the compromise of additional actions, notably the widely used tj-actions/changed-files action, causing repositories to leak secrets.

What Happened?

See the detailed report from Wiz Research: Wiz Blog Post

Compromise Time Period: March 11, 2025, between 18:42 and 20:31 UTC

How did this happen?

The investigation is still ongoing. We can tell the attacker gained sufficient access to update the v1 tag to the malicious code they had placed on a fork of the repository. The reviewdog GitHub Organization has a relatively large contributor base and appears to be actively adding contributors through automated invites. This increases the attack surface for a contributor’s access to have been compromised or contributor access to have been gained maliciously.
— https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup

The reviewdog organization indeed automatically invited contributors to the org and granted write access for maintenance of reviewdog actions. Contributors who submitted to reviewdog/action-* repositories were automatically invited to the @reviewdog/actions-maintainer team, which had write access to these repositories. The team consisted of 118 members at the time of writing. We suspect the attacker gained write access through this automated inviter flow or compromised an existing contributor’s account. (I could see invited members since Jan 15 from security log and found no suspicious users.)

Note: Those contributors do not have write access to the main reviewdog repository or related core repositories (e.g., errorformat).

Known Affected Actions

• reviewdog/action-setup@v1 (other tags could also be impacted, but no trace found so far)
• reviewdog/action-shellcheck@{<v1.29.2}
• reviewdog/action-composite-template@{<v0.20.2}
• reviewdog/action-staticcheck@{<v1.26.2}
• reviewdog/action-ast-grep@{<v1.26.2}
• reviewdog/action-typos@{<v1.17.2}

Other actions may also be impacted, though no additional evidence has been found at this time.

Immediate Actions Taken

• Disabled automated inviter workflow.
• Removed write access from most contributors except a select few trusted maintainers.
• Updated all reviewdog repositories to explicitly specify GitHub Actions by commit SHA.
• Pinned reviewdog binary installation scripts explicitly with commit SHAs.
• Confirmed no suspicious activity in my and bot accounts' security logs.
• Rotated or deleted Personal Access Tokens (PAT) for my and bot accounts (@review-dog).

Recommended User Actions

• Check whether your repository was impacted using the Wiz-provided GitHub query.
• Pin all GitHub Actions explicitly to commit hashes instead of version tags to protect against future supply chain attacks. Ensure actions do not internally use other actions by version tags.
  • For reference, reviewdog actions have now pinned internal dependencies explicitly. (pinact tool used for pinning)
• Consider directly installing and using the reviewdog binary instead of reviewdog/action-* if you want to completely eliminate the risk of GitHub Action-based supply chain attacks.

We sincerely apologize for the inconvenience and appreciate your cooperation and understanding as we resolve this issue. Security remains our utmost priority.

For further assistance or questions, please comment below.