As the repo is was taken down is someone able to tell me when was the malicious ...

imnotjames · 2025-03-15T14:09:32 1742047772

Your secrets will be published to the CI log if you were affected.

I believe it's everything since around 10pm ET last night. I would consider any runs in the past 24 hours to be suspect.

v1sionSec · 2025-03-15T14:44:58 1742049898

Thank you, unfortunately we have a multiple of repositories with multiple runs that use this action so checking the logs one by one will be hard. Any idea how to get all logs? Thank you

mongrelion · 2025-03-15T18:23:18 1742062998

I think your best bet is to traverse all the pipeline logs that make use of the action using Github's REST API.

It should be easy to do with thr Github CLI tool and some bash scripting.

Not sure how easy it'll be to parse the logs to look for a base64 string but it shouldn't be that complicated either.

mixologic · 2025-03-15T15:37:12 1742053032

also the secrets will be published as double base 64 encoded, so it will just look like a string of random chars at the end of the changed-files action in the log.

imnotjames · 2025-03-15T19:24:57 1742066697

If you are using the action and were as of 10p ET last night I would assume everything is compromised, remove the action, and rotate secrets.

alper · 2025-03-15T15:05:52 1742051152

Somewhere after 18:00 CET Friday.