What Actually Happened
A coordinated supply chain attack has compromised eight packages on Packagist, introducing malicious code designed to execute a Linux binary from a GitHub Releases URL. The attack specifically targeted Composer packages, but the malicious code was inserted into package.json files instead of the expected composer.json, exploiting cross-ecosystem placement that could evade detection by developers focusing solely on PHP dependencies.
The Implementation Reality
This incident highlights a critical vulnerability in how supply chains are monitored and verified. By using package.json to introduce malicious scripts, attackers have found a way to bypass typical Composer scanning practices. Teams using Composer for PHP projects should consider that their JavaScript build tooling may also be a vector for attack, especially if it integrates with CI/CD pipelines that run postinstall scripts.
The specific attack vector involves a postinstall script that downloads a binary to the /tmp/.sshd folder, sets its permissions to executable, and runs it in the background. This can lead to remote code execution (RCE) during installation or build workflows. Given that the malicious payload was referenced across 777 files in GitHub, there’s a significant chance that this is just one part of a broader campaign, indicating that the extent of the compromise could be substantial.
As the malicious GitHub account hosting the binary is no longer available, the nature of the payload remains unclear, but the methods of execution suggest a sophisticated approach that could evade traditional security measures. The use of workflow files to trigger these scripts during GitHub Actions jobs further complicates detection.
What to Do About It
- Review all
package.jsonfiles in your repositories for unauthorizedpostinstallscripts, especially those that interact with external URLs. - Implement strict auditing and monitoring of dependencies in both Composer and npm contexts to catch malicious changes before they propagate.
- Update CI/CD pipelines to include security checks that scan for unexpected scripts, and block any that attempt to download binaries from external sources.
- Educate development teams about the risks of cross-ecosystem dependencies and the importance of validating all package sources, not just Composer metadata.
- Consider integrating security tools such as Snyk or Dependabot that can provide additional layers of dependency monitoring and vulnerability scanning.
Source: The Hacker News
At q52, we specialize in AI-augmented security operations and SIEM implementation. Let us help you operationalize threat detection with LLM enrichment — faster triage, fewer false positives, and security intelligence your team can actually act on. Learn about Noogenesis, our AI-powered SIEM platform and connect with us on LinkedIn.