Multiple Reviewdog actions were compromised during a specific time period

A GitHub action used to install reviewdog was compromised for about 2 hours on March 11, 2025, and injected malicious code that exposed sensitive secrets in workflow logs. This affected multiple related actions and any workflow using them during that time period.

reviewdog/action-setup@v1 was compromised (2025-03-11, 18:42–20:31 UTC) and contained malicious code exfiltrating GitHub Actions secrets to workflow logs. The vulnerability affects downstream actions (action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep, action-typos) regardless of version pinning. Attack vector is supply-chain; impact includes exposure of repository secrets, tokens, and credentials in publicly accessible logs.