prt-scan

prt-scan is a multi-wave software supply chain threat activity cluster focused on exploiting GitHub Actions workflows that use the pull_request_target trigger in unsafe ways. The actor conducted large-scale automated pull request operations beginning in March 2026, using multiple GitHub accounts to identify vulnerable repositories, fork them, modify CI-executed files, and submit malicious pull requests designed to run in the security context of the target repository. The campaign targeted both prominent open-source organizations and smaller hobbyist projects, with observed injections tailored to Python, Node.js, Go, Rust, and GitHub Actions environments. The actor’s primary objective was theft of CI/CD secrets and related credentials. Observed tradecraft included exfiltrating GitHub workflow tokens, enumerating repository and organization secrets metadata, probing cloud metadata services, and attempting to expose additional secrets through workflow logs and pull request comments. When package publishing credentials were discovered, the actor attempted follow-on supply chain abuse by publishing trojanized package versions. Confirmed downstream impact included compromise of npm packages associated with at least two projects, and a later intrusion affecting multiple AsyncAPI packages after theft of an npm publish token through the same pull_request_target abuse pattern. Across the campaign, the actor opened well over 500 malicious pull requests over six waves and evolved from crude shell-based payloads to AI-assisted, repository-aware wrappers adapted to the target language and build environment. Payload logic commonly followed staged exfiltration and reconnaissance flows, with attempts to dump environment variables, inspect workflow configuration, trigger additional workflows, and bypass label- or approval-based controls. Despite the scale of activity, the operator has been assessed as relatively low sophistication because many payloads misunderstood GitHub permission boundaries and several attack stages were ineffective in typical repository configurations. In successful cases, prt-scan demonstrated capabilities spanning initial access, reconnaissance, credential theft, exfiltration, persistence, and post-exploitation. In the AsyncAPI-related package compromise, malicious runtime code fetched additional staged payloads, established host persistence across major operating systems, and enabled remote shell execution. Code associated with that later payload also contained disabled functionality for credential harvesting, propagation, evasion, mutation, and poisoning of AI-development tooling. Attribution beyond the activity cluster itself remains inconclusive; branding found in later-stage malware has not been established as reliable evidence of actor identity.