GitHub targeted in supply chain attack

The 'tj-actions/changed-files' GitHub Action recently suffered a supply chain breach, baring sensitive secrets from CI/CD logs. Crafty attackers crept in using a GitHub personal access token tied to a bot account, enabling them to smuggle out data. Their cunning involved embedding harmful code to extract CI/CD secrets, including AWS keys and private RSA keys. GitHub swiftly revoked the compromised token, bolstered security protocols, and advised immediate secret rotation coupled with a thorough workflow assessment. To fend off similar perils, they recommend pinning dependencies and deploying real-time Data Loss Prevention (DLP) solutions.