On: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

[mongrelion]

I think your best bet is to traverse all the pipeline logs that make use of the action using Github's REST API.

It should be easy to do with thr Github CLI tool and some bash scripting.

Not sure how easy it'll be to parse the logs to look for a base64 string but it shouldn't be that complicated either.