Supply Chain Attacks Targeting GitHub Actions Increased in 2025

Supply Chain Attacks Targeting GitHub Actions Increased in 2025, with researchers highlighting that threat actors have exploited vulnerabilities in GitHub by compromising open-source packages and misconfigured GitHub Actions to access secrets. At Black Hat Europe in London, Amitai Cohen and Wiz’s principal security researcher Rami McCarthy urged a shared responsibility model for open source software, noting that GitHub’s role in the software supply chain is significant but not exclusively responsible for security.

The incidents include Ultralytics, Singularity, Shibaud/Shai-Hulud, and the tj-actions/changed-files GitHub Action, which was linked to a CVE-2025-30066 advisory from CISA after an attack on Coinbase that impacted nearly 70,000 of its customers. McCarthy stresses that attackers could grab secrets if configurations are careless and that victims often struggle to identify who operated the attack or what payloads were used.

The article quotes Cohen and McCarthy on the need for the community to address these vulnerabilities as a shared issue rather than leaving protection solely to GitHub. It also notes that GitHub remains the most widely used code repository, making it an attractive target for threat actors and underscoring the importance of using available security features. December 12, 2025.