Quick Takeaways
- A threat actor used AI-assisted automation to launch hundreds of exploit attempts on GitHub repositories, successfully compromising at least two NPM packages.
- The campaign, dubbed “prt-scan,” targeted repositories with GitHub’s pull_request_target feature, opening over 500 pull requests with malicious payloads but mainly affecting small hobbyist projects.
- Despite many attempts, only about 10% succeeded, exposing ephemeral credentials and highlighting how AI automation simplifies large-scale supply chain attacks.
- The attacker’s flawed but rapid multi-phase payload demonstrated a lack of understanding of GitHub permissions, yet still led to multiple compromises, underscoring the need for better environment hardening.
AI-Driven Attacks Hit GitHub Repositories
Recently, a threat actor used artificial intelligence (AI) to automate hundreds of hacking attempts on GitHub open source projects. These attacks began around March 11 and continued in waves, with the attacker trying to compromise various projects. Although fewer than 10% of the attempts succeeded, at least two NPM packages were compromised. The activity was first identified on April 2 and involved six different GitHub accounts linked to one attacker. This shows how AI technology can make cyberattacks faster and easier for even low-skill hackers.
New Campaign Highlights Growth in Supply Chain Risks
This recent campaign, called “prt-scan,” followed a similar but shorter attack in February, dubbed “hackerbot-claw.” The earlier attack targeted well-known repositories to steal important secrets like API keys and credentials. In contrast, the “prt-scan” campaign was broader, launching over 500 pull requests on many small and large projects. Most successful breaches exposed only temporary credentials, without gaining access to protected systems. Experts warn that AI helps attackers send many more attacks quickly and with less effort, increasing the risk for organizations relying on open-source software. Developers often use pull requests to suggest changes, which, if misused, can become a security loophole. Overall, these attacks underline how AI tools can contribute to large-scale supply chain threats, even if many attempts fail.
Expand Your Tech Knowledge
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Stay inspired by the vast knowledge available on Wikipedia.
CyberRisk-V1
