Prt-Scan Supply Chain Campaign - Hidden Workflow File Creation

Elgonad .@elgonad

•updated Apr 7, 2026•3•0•120

Detects the creation of hidden temporary workflow files (e.g., .prt_tmp_<nonce>.yml) indicative of the prt-scan supply chain campaign's DISPATCH phase used to capture secret values. This rule specifically looks for newly written script files with a filename matching the pattern /.github/workflows/.prt_tmp_[a-f0-9]+\.yml$/i.