A coordinated supply chain attack compromised eight packages on Packagist, the primary repository for PHP Composer dependencies. The attack injected malicious code into package.json files rather than composer.json, targeting JavaScript projects within PHP packages.

The malware retrieves and executes a Linux binary hosted on GitHub Releases. This approach allowed attackers to bypass initial detection by placing payload execution code in JavaScript configuration files instead of the expected PHP manifest. Security firm Socket identified the campaign and disclosed eight affected packages.

The attack exploits a common development practice where PHP packages bundle JavaScript dependencies or build tools. Developers installing these compromised packages would pull the malicious code into their projects. When build processes or dependency installations execute, the malware downloads the Linux binary from GitHub and runs it with the privileges of the developer or CI/CD system.

This supply chain vector proves effective because developers typically trust packages from established repositories like Packagist. The attackers leveraged this trust to distribute what researchers describe as a "coordinated" campaign, suggesting multiple packages compromised in a planned operation rather than isolated incidents.

The GitHub Releases hosting adds an evasion layer. Attackers controlled the binary's delivery independently from package repositories, allowing them to modify or remove the payload after initial distribution. This separates the malicious artifact from the compromised source code, complicating forensic analysis and remediation.

Organizations running affected packages face execution of unknown binaries within their development or production environments. The Linux binary's capabilities remain unclear pending analysis, but typical supply chain malware targets secrets, credentials, source code, or cryptocurrency wallets.

Packagist maintainers and affected package authors have been notified. Developers should audit their projects for these eight packages and review package.json files in their dependency trees. Those using composer or npm should update to patched versions once released and regenerate any exposed credentials or API tokens.

Socket