On March 23, the founder of Slow Fog, Yu Xian, posted on social media, "A supply chain attack on Coinbase using GitHub Actions CI/CD mechanism was fortunately prevented from further success, otherwise the next exposed security incident would have been targeting Coinbase.

The supply chain attack path on GitHub: reviewdog/action-setup -> tj-actions/changed-files -> coinbase/agentkit -> stealing GitHub Personal Access Token (PAT), cloud service-related keys, etc. If an enterprise uses reviewdog or tj-actions, they should conduct a self-examination."