---
id: 6874
title: "Six Accounts, One Actor: Inside the prt-scan Supply Chain Campaign"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/six-accounts-one-actor-inside-the-prt-scan-supply-chain-campaign"
published_at: "2026-04-04T09:36:51Z"
tags: ["ai-security", "supply-chain", "github-actions", "npm", "ci-cd", "wiz", "threat-actor", "pull-request-target"]
phying_url: "https://phying.com/item/6874"
lang: en
---

# Six Accounts, One Actor: Inside the prt-scan Supply Chain Campaign

## Summary

Wiz Research traced six waves of pull_request_target exploitation to one actor three weeks before disclosure: 500+ PRs, two npm packages hit, payloads evolving from bash to AI-generated.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-04-04T09:36:51Z
- **Original:** https://www.wiz.io/blog/six-accounts-one-actor-inside-the-prt-scan-supply-chain-campaign
- **Phying News:** https://phying.com/item/6874