
AI PR campaign abuses pull_request_target to steal CI secrets
Wiz reports the “prt-scan” campaign opened 500+ malicious PRs abusing GitHub Actions `pull_request_target`, leaking runner secrets and compromising at least two npm packages.
NewsSupply ChainCI/CD
2 minYesterday
