由于供应链攻击，23000 个组织使用的 GitHub 工具泄露了敏感凭据。 A GitHub tool used by 23,000 orgs leaked sensitive credentials due to a supply chain attack.

超过 23,000 个组织使用 GitHub 的“tj-actions/changed-files”工具的供应链攻击，由于攻击者注入的恶意代码，暴露了 API 密钥和访问令牌等敏感信息。 A supply chain attack on GitHub's "tj-actions/changed-files" tool, used by over 23,000 organizations, exposed sensitive information like API keys and access tokens due to malicious code injected by attackers. 尽管 GitHub 删除了恶意代码并恢复了该工具，但专家建议用户查看和更新他们的存储库，并轮换任何泄露的机密以降低风险。 Though GitHub removed the malicious code and restored the tool, experts recommend users review and update their repositories and rotate any compromised secrets to mitigate risks.