build-pipeline-compromiseleaked-secret-api-keyai-enabled-threat-activityvendor-distribution-compromise

AI-Assisted GitHub Actions Campaign Exploited `pull_request_target` to Steal Secrets

Supply Chain Risk · 5 sources · Updated 4mo ago · First seen Mar 27, 2026

Researchers reported that the prt-scan campaign abused misconfigured GitHub Actions workflows using the pull_request_target trigger to run attacker-controlled code from forked pull requests in privileged CI contexts. The actor used at least six GitHub accounts to submit more than 500 malicious pull requests across six waves, disguising many as routine CI updates and tailoring payloads to Python, Node.js, Go, Rust, and GitHub Actions repositories. Wiz said the operation evolved from simple bash payloads into AI-assisted, repository-aware implants designed to steal GITHUB_TOKEN values, enumerate secrets, probe cloud metadata services, and exfiltrate credentials through workflow logs and pull request comments.

The campaign succeeded often enough to cause real supply-chain impact despite an estimated success rate below 10%. Wiz confirmed compromise of the npm packages @codfish/eslint-config and @codfish/actions across 106 versions, and verified theft of AWS keys, Cloudflare API tokens, and Netlify authentication tokens. High-profile projects including Sentry, OpenSearch, IPFS, NixOS, Jina AI, and recharts reportedly blocked the attempts through contributor approval gates and workflow restrictions. The activity follows earlier warnings from Sysdig that insecure use of pull_request_target in prominent repositories such as MITRE, Splunk, and Spotipy could expose secrets and high-privilege GITHUB_TOKEN permissions, underscoring that unsafe GitHub Actions defaults remain an active software supply-chain risk.

Does this reach your builds?Trace attribution and downstream blast radius.

Trace the chain

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Jun 17, 2025 – Apr 4, 2026

Apr 4, 20267mo ago
Attacker compromises two npm packages during prt-scan
During the campaign, the attacker successfully compromised the npm packages @codfish/eslint-config and @codfish/actions across 106 versions. Wiz also verified theft of credentials including AWS keys, Cloudflare API tokens, and Netlify auth tokens.
prt-scan: AI-Powered GitHub Actions Supply Chain Attack | Wiz Blog
Apr 4, 20267mo ago
Wiz publicly discloses the prt-scan campaign
Wiz Research published details of the prt-scan campaign, describing six waves of attacks from March 11 through early April 2026 and attributing them to one actor using six GitHub accounts. The disclosure highlighted AI-assisted, repository-aware payloads and a success rate below 10% despite real compromises.
prt-scan: AI-Powered GitHub Actions Supply Chain Attack | Wiz Blog
Apr 2, 20267mo ago
prt-scan campaign spikes with 475+ pull requests in 26 hours
On April 2, 2026, the GitHub account ezmtebo submitted more than 475 malicious pull requests in a 26-hour burst as part of the prt-scan campaign. The wave was part of a broader operation that exceeded 500 malicious pull requests overall.
prt-scan: AI-Powered GitHub Actions Supply Chain Attack | Wiz Blog
Mar 11, 20268mo ago
prt-scan campaign begins targeting GitHub repositories
A threat actor began the prt-scan supply chain campaign on GitHub, exploiting repositories with misconfigured pull_request_target workflows to steal tokens, secrets, and cloud credentials. Wiz linked the activity to a single actor operating through multiple GitHub accounts.
prt-scan: AI-Powered GitHub Actions Supply Chain Attack | Wiz Blog
Jun 17, 20251y ago
Splunk patches vulnerable workflow in security_content repository
Splunk patched the insecure GitHub Actions workflow in its security_content repository, though the report says it did not acknowledge the disclosure. The vulnerable configuration exposed privileged workflow execution to untrusted pull request code.
Dangerous by default: Insecure GitHub Actions found in MITRE, Splunk, and other open source repositories | Sysdig
Jun 17, 20251y ago
MITRE remediates vulnerable GitHub Actions workflow
MITRE remediated the vulnerable workflow in its mitre-attack/car repository after Sysdig's disclosure. The flaw allowed untrusted forked pull request code to execute in a privileged CI context.
Dangerous by default: Insecure GitHub Actions found in MITRE, Splunk, and other open source repositories | Sysdig
Jun 17, 20251y ago
Spotipy fixes vulnerable workflow and assigns CVE-2025-47928
After disclosure of the insecure GitHub Actions issue, the Spotipy project remediated its vulnerable workflow and assigned CVE-2025-47928 to the flaw. The issue involved unsafe use of pull_request_target that could expose secrets and privileged GitHub token access.
Dangerous by default: Insecure GitHub Actions found in MITRE, Splunk, and other open source repositories | Sysdig
Jun 17, 20251y ago
Sysdig identifies insecure GitHub Actions in major open-source repositories
Sysdig Threat Research Team found multiple high-profile open-source repositories vulnerable to insecure GitHub Actions workflows, primarily involving misuse of the pull_request_target trigger that allowed untrusted pull request code to run in privileged contexts. The researchers demonstrated compromise paths in repositories including spotipy-dev/spotipy, mitre-attack/car, and splunk/security_content.
Dangerous by default: Insecure GitHub Actions found in MITRE, Splunk, and other open source repositories | Sysdig

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

1 linked

prt-scan

Affected products

1 linked

Github

Organizations

1 linked

GitHub

Breaches

1 linked

CODFISH-2026-03

Observables

7 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See attribution and downstream blast radius, and whether this package or vendor reaches your builds.

Trace the Supply Chain

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Apr 6, 2026

New GitHub Actions Attack Chain Uses Fake CI Updates to Exfiltrate Secrets and TokensOpen source ↗

Dark ReadingNews · Apr 6, 2026

AI-Assisted Supply Chain Attack Targets GitHubOpen source ↗

Ramimac BlogNews · Apr 4, 2026

prt-scan: AI-Powered GitHub Actions Supply Chain Attack | Wiz BlogOpen source ↗

Wiz BlogNews · Apr 4, 2026

prt-scan: AI-Powered GitHub Actions Supply Chain Attack | Wiz BlogOpen source ↗

Sysdig BlogNews · Jun 17, 2025

Dangerous by default: Insecure GitHub Actions found in MITRE, Splunk, and other open source repositories | SysdigOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

build-pipeline-compromiseleaked-secret-api-keyai-enabled-threat-activityvendor-distribution-compromise

AI-Assisted GitHub Actions Campaign Exploited `pull_request_target` to Steal Secrets

Supply Chain Risk · 5 sources · Updated 4mo ago · First seen Mar 27, 2026

Does this reach your builds?Trace attribution and downstream blast radius.

Trace the chain

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Jun 17, 2025 – Apr 4, 2026

Apr 4, 20267mo ago
Attacker compromises two npm packages during prt-scan
During the campaign, the attacker successfully compromised the npm packages @codfish/eslint-config and @codfish/actions across 106 versions. Wiz also verified theft of credentials including AWS keys, Cloudflare API tokens, and Netlify auth tokens.
prt-scan: AI-Powered GitHub Actions Supply Chain Attack | Wiz Blog
Apr 4, 20267mo ago
Wiz publicly discloses the prt-scan campaign
Wiz Research published details of the prt-scan campaign, describing six waves of attacks from March 11 through early April 2026 and attributing them to one actor using six GitHub accounts. The disclosure highlighted AI-assisted, repository-aware payloads and a success rate below 10% despite real compromises.
prt-scan: AI-Powered GitHub Actions Supply Chain Attack | Wiz Blog
Apr 2, 20267mo ago
prt-scan campaign spikes with 475+ pull requests in 26 hours
On April 2, 2026, the GitHub account ezmtebo submitted more than 475 malicious pull requests in a 26-hour burst as part of the prt-scan campaign. The wave was part of a broader operation that exceeded 500 malicious pull requests overall.
prt-scan: AI-Powered GitHub Actions Supply Chain Attack | Wiz Blog
Mar 11, 20268mo ago
prt-scan campaign begins targeting GitHub repositories
A threat actor began the prt-scan supply chain campaign on GitHub, exploiting repositories with misconfigured pull_request_target workflows to steal tokens, secrets, and cloud credentials. Wiz linked the activity to a single actor operating through multiple GitHub accounts.
prt-scan: AI-Powered GitHub Actions Supply Chain Attack | Wiz Blog
Jun 17, 20251y ago
Splunk patches vulnerable workflow in security_content repository
Splunk patched the insecure GitHub Actions workflow in its security_content repository, though the report says it did not acknowledge the disclosure. The vulnerable configuration exposed privileged workflow execution to untrusted pull request code.
Dangerous by default: Insecure GitHub Actions found in MITRE, Splunk, and other open source repositories | Sysdig
Jun 17, 20251y ago
MITRE remediates vulnerable GitHub Actions workflow
MITRE remediated the vulnerable workflow in its mitre-attack/car repository after Sysdig's disclosure. The flaw allowed untrusted forked pull request code to execute in a privileged CI context.
Dangerous by default: Insecure GitHub Actions found in MITRE, Splunk, and other open source repositories | Sysdig
Jun 17, 20251y ago
Spotipy fixes vulnerable workflow and assigns CVE-2025-47928
After disclosure of the insecure GitHub Actions issue, the Spotipy project remediated its vulnerable workflow and assigned CVE-2025-47928 to the flaw. The issue involved unsafe use of pull_request_target that could expose secrets and privileged GitHub token access.
Dangerous by default: Insecure GitHub Actions found in MITRE, Splunk, and other open source repositories | Sysdig
Jun 17, 20251y ago
Sysdig identifies insecure GitHub Actions in major open-source repositories
Sysdig Threat Research Team found multiple high-profile open-source repositories vulnerable to insecure GitHub Actions workflows, primarily involving misuse of the pull_request_target trigger that allowed untrusted pull request code to run in privileged contexts. The researchers demonstrated compromise paths in repositories including spotipy-dev/spotipy, mitre-attack/car, and splunk/security_content.
Dangerous by default: Insecure GitHub Actions found in MITRE, Splunk, and other open source repositories | Sysdig

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →