prt-scan
Named by 2 kept items in this workspace.
1 items name it under classification.key entities and 1 under threat actors.
Search every workspace for prt-scan. It matches the name as written, so it can find other things that share it.
The items that name it 2
Campaign/tool where attackers scan GitHub specifically for repos with pull_request_target enabled; opened a few hundred PRs across repos in about a day.
All threat actors in this workspace.