On March 14, 2025, the widely-used GitHub Action tj-actions/changed-files was compromised, putting countless repositories at risk of secret exposure. At Garnet, we closely analyzed this incident and can confidently say that we would've detected this attack at the very moment it began. Let's break down the attack and show precisely how our real-time monitoring, powered by deep behavioral analysis, would have alerted teams instantly.

Memory Dumping through a malicious GitHub Action

In short, attackers gained control of the popular tj-actions/changed-files repository and silently injected malicious code into versions from v1.0.0 to v45.0.7. They force-pushed malicious tags, causing unsuspecting workflows to execute code that fetched and ran a malicious script (memdump.py) hosted on GitHub Gist. This script scanned the GitHub Actions runner memory for secrets, extracted sensitive credentials, and printed them to logs—making these secrets accessible, especially in public repositories.

Indicators of Compromise (IoCs):

• Malicious Commit SHA: 0e58ed8671d6b60d0890c21b07f8835ace038e67
• Gist URL: https://gist.githubusercontent.com/nikitastupin/30e525b776c409e03c2d6f328f254965/raw/memdump.py
• Suspicious encoded logs: Double Base64-encoded JSON blobs containing extracted secrets.

Attack Chain Simplified

Here's how the attack unfolded in simple terms:

1. Developer workflow uses compromised action (uses: tj-actions/changed-files@v45.0.7).
2. Malicious action downloads memdump.py using curl:

3. memdump.py reads /proc/[pid]/mem, extracts CI secrets, double-encodes them, and prints them in CI logs.
4. Secrets leak publicly (in public repos) via CI logs.

How Garnet Would Have Caught This Attack

The section below details how garnet team would have been able to to catch the tj-actions/changed-files attack in real-time—leveraging findings by simulating the exploit behavior inside GitHub Actions runners when the memdump.py payload was triggered.

Here's exactly how:

1. Suspicious Network Activity Detected

Garnet actively monitors every outbound network connection made by your CI workflows. During our earlier analysis of the Ultralytics incident (which leveraged the same malicious memdump.py), our sensors triggered critical detections for suspicious external calls:

• Critical detection: Network suspicious tool shell extension; curl retrieving scripts from GitHub Gists (gist.githubusercontent.com).

Connecting directly to unknown Gists or suspicious remote hosts would instantly trigger a critical alert in Garnet—giving your team immediate visibility.

2. Real-Time File Access & Memory Dump Detection

The hallmark of this attack is the malicious reading of process memory from /proc/[pid]/mem. Garnet proactively detects such abnormal file interactions:

This detection is critical: A legitimate workflow has no reason to directly read GitHub Actions runner memory.

3. Clear Process Ancestry Visualization

In the tj-actions attack scenario, the malicious activity follows a suspicious process chain:

• Runner.Worker → bash → curl → sudo python3 memdump.py

Garnet captures and visualizes this process lineage clearly, making anomalous activities obvious and actionable at a glance.

4. Comprehensive Behavioral Correlation & Alerting

Combining suspicious DNS requests, command-line activity, and abnormal file access provides a comprehensive behavioral context. Even if attackers blend malicious commands within legitimate scripts, Garnet's contextual correlation instantly detects and surfaces threats:

• DNS anomalies (unexpected remote connections)
• Unusual command executions (especially involving memory access)
• High-risk file operations (e.g., /proc/[pid]/mem access)

All these events trigger immediate notifications to your team's preferred channel—Slack, PR comments, or SEIM.

5. How Would This Have Played Out in Practice?

Had Garnet been active in pipelines utilizing tj-actions/changed-files, the following alerts would've appeared in real-time:

• Critical: curl fetching remote gist script (memdump.py).
• Critical: Suspicious DNS activity (gist.githubusercontent.com).
• Critical: Unauthorized memory read via Python process (/proc/[pid]/mem).

These detections would've enabled immediate containment—halting the build, rotating exposed secrets, and initiating incident response procedures long before any secrets became publicly visible.

Conclusion: Garnet as Your First Line of Defense

The tj-actions/changed-files supply chain attack serves as a stark reminder: modern development requires more than dependency scanning or static analysis alone. Attackers constantly evolve their tactics, targeting dynamic runtime behaviors that static tools can't detect.

Garnet closes that gap with:

• Kernel-level visibility into runtime behaviors
• Real-time alerts on suspicious actions
• Automated actionable guidance integrated directly into developer workflows

Had Garnet been integrated with affected repositories, organizations would've instantly been alerted to the malicious activity, dramatically reducing the damage from the tj-actions compromise.

Takeaways:

• Always pin GitHub Actions to verified commit SHAs
• Implement behavior-based runtime detection
• Immediately rotate CI secrets after exposure incidents