# Reconstructing the TJ Actions Changed Files GitHub Actions Compromise

DevFeed: [Reconstructing the TJ Actions Changed Files GitHub Actions Compromise](<https://devfeed.tech/articles/reconstructing-the-tj-actions-changed-files-github-actions-compromise-8060.md>)

Original publisher: [Read original article](<https://snyk.io/blog/reconstructing-tj-actions-changed-files-github-actions-compromise/>)

Author: Micah Silverman

Published: 2025-03-17T04:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [ci](<https://devfeed.tech/topics/ci.md>)

Tags: [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [ci](<https://devfeed.tech/tags/ci.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [exploits](<https://devfeed.tech/tags/exploits.md>), [git](<https://devfeed.tech/tags/git.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [logs](<https://devfeed.tech/tags/logs.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>), [workflows](<https://devfeed.tech/tags/workflows.md>)

## AI overview

Snyk analyzes the compromise of the tj-actions/changed-files GitHub Action, which could expose encrypted secrets as plaintext in action logs. It explains the role of manipulated release tags and orphaned commits and discusses remediation for GitHub workflows.

## Source excerpt

A critical security exploit in the popular GitHub Action changed-files (tj-actions/changed-files) exposed encrypted secrets in plaintext within GitHub Action logs. This vulnerability, affecting over 23,000 repositories, was enabled by orphaned commits and manipulated release tags. Learn how to protect your GitHub workflows from similar exploits.