A sophisticated supply chain attack targeting Coinbase has been traced to a single stolen token from a SpotBugs workflow. The attack, which began in November 2024 and culminated in March 2025, compromised multiple GitHub projects through a carefully orchestrated series of breaches.

## The Attack Timeline

The attack unfolded in several stages:

– **November 2024**: A SpotBugs maintainer inadvertently exposed their Personal Access Token (PAT) in a CI workflow
– **December 6, 2024**: Attackers exploited a vulnerable ‘pull_request_target’ workflow to steal the maintainer’s PAT using a throwaway account
– **March 11, 2025**: The stolen PAT was used to invite another dummy user to SpotBugs, who then pushed a malicious workflow that exfiltrated a Reviewdog maintainer’s PAT
– **March 14, 2025**: The attack chain continued through multiple repositories, eventually targeting Coinbase’s infrastructure

## Impact and Scope

The cascading attack compromised several critical components:

– SpotBugs (initial breach)
– Reviewdog
– tj-actions/changed-files
– 218 repositories had secrets exposed

Palo Alto Networks’ Unit 42 researchers discovered that the attackers specifically targeted Coinbase’s ‘agentkit’ repository. Despite executing the tainted code, Coinbase’s secrets remained protected, and the company quickly removed the compromised workflow after being alerted.

## Security Implications

This incident highlights significant vulnerabilities in the open-source ecosystem:

– Tag mutability issues in GitHub Actions
– Insufficient audit logging
– Weak chain of trust between repositories

## Recommended Mitigations

Organizations should take immediate action:

1. Rotate all secrets in projects that used the compromised actions
2. Audit GitHub Actions logs from March 10-14, 2025, for exposed secrets
3. Pin dependencies using commit hashes instead of tags
4. Avoid using ‘pull_request_target’ unless absolutely necessary

This meticulously planned attack demonstrates the growing sophistication of supply chain threats and the need for enhanced security practices in CI/CD environments.