<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p>I was reading about CVE-2025-30066. I must admit that my
git-knowledge is close to nil, but if I'm reading the description
right then this CVE is describing a pathway which let bad-actors
potentially gain keys to other projects in GitHub. </p>
<p>
<blockquote type="cite">Projects that used the compromised version
of <strong>tj-actions/changed-files</strong> between March 12,
2025, 00:00 and March 15, 2025, 12:00 UTC are at high risk. In
these cases, sensitive credentials may have been exposed via
public logs. [From <a href="https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/">sysdig.com</a>]<br>
</blockquote>
</p>
<p>And since I know that ISC has projects at GitHub, and I suspect
that ISC projects would be a big, fat, juicy target for code
injection, I feel like I gotta ask . . Is ISC willing to weigh in
and say if their projects may have been affected, or if
credentials for their projects may have been exposed?</p>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
--
Do things because you should, not just because you can.
John Thurston 907-465-8591
<a class="moz-txt-link-abbreviated" href="mailto:John.Thurston@alaska.gov">John.Thurston@alaska.gov</a>
Department of Administration
State of Alaska</pre>
</body>
</html>