Loading story…
A malicious intercom/intercom-php 5.0.2 package was uploaded to Packagist after an attacker abused compromised publishing rights, turning the legitimate PHP SDK into a Composer plugin that executed malware during install or update. Reports say the package launched setup-intercom.sh, downloaded Bun, and ran an obfuscated router_runtime.js payload tied to the Mini Shai-Hulud campaign, which had previously been linked to a compromised Intercom npm package. Because the payload ran at dependency installation time, affected developer workstations and CI/CD pipelines could be compromised even if the library was never imported by the application.
The malware was described as enabling arbitrary code execution with the privileges of the user running Composer, then harvesting environment variables and credential files from developer, cloud, Kubernetes, Vault, Docker, and application environments. Stolen data was encrypted and exfiltrated to a hardcoded endpoint with a fallback GitHub-based channel, creating risks including unauthorized AWS activity, access to private S3 buckets, Route53 manipulation, and database theft or destruction. Researchers said the campaign also sought downstream software supply-chain propagation by seeding additional malicious packages, while Packagist removed the artifact after disclosure and defenders were urged to audit installs, inspect repositories and build logs, and rotate exposed credentials.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-07, reporting attributed the malicious intercom/intercom-php 5.0.2 package to the Mini Shai-Hulud campaign. The analysis described broad credential exfiltration, arbitrary code execution in Composer contexts, and downstream supply-chain propagation using compromised publishing rights.
On 2026-05-06, a report detailed CVE-2026-42223 in Nginx UI, where improper JSON serialization exposed cryptographic secrets through a settings API to authenticated users. Those leaked secrets could be used to forge administrative JWT sessions and bypass role-based access controls.
A report published on 2026-05-05 described CVE-2026-42220 in Nginx UI, where information disclosure could expose the init user context and lead to administrative control of the management interface. The write-up also noted backup and restore abuse paths that could expose archives and enable malicious configuration restoration.
On 2026-04-30, PyPI quarantined malicious Lightning (PyTorch Lightning) releases tied to the Mini Shai-Hulud supply-chain campaign. The incident showed the operation extended beyond PHP packages into the Python ecosystem, using trusted package updates to deliver credential-stealing malware.
After identifying the compromised intercom/intercom-php package, Socket reported it to Packagist, which removed the malicious artifact. Socket also warned organizations to audit affected environments and rotate potentially exposed credentials.
On 2026-04-30, a malicious artifact replaced the legitimate intercom/intercom-php version 5.0.2 on Packagist. The tampered release turned the package into a Composer plugin that executed malware during install or update, enabling credential theft and supply-chain propagation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
resecurity.com
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Mini Shai-Hulud** campaign compromised widely used developer packages across **npm, PyPI, and Packagist/Composer**, including SAP CAP components, `intercom-client`, `intercom/intercom-php`, and PyTorch Lightning’s `lightning` package. The malicious releases delivered an obfuscated credential stealer executed with the **Bun** runtime, harvesting secrets from developer workstations and CI/CD environments, including GitHub, npm, cloud, Kubernetes, and AI tooling credentials. Stolen data was encrypted and exfiltrated through attacker-created public GitHub repositories, and the campaign was linked by multiple researchers to **TeamPCP**. Reports estimated exposure ranging from more than **1,000** to roughly **1,800 repositories**, with no `CVE`, `GHSA`, or `OSV` identifiers assigned at disclosure. Investigators said the attackers abused software publishing workflows rather than relying solely on direct maintainer compromise, including a stolen npm token tied to SAP’s `cloudmtabot` account, an exposed token in CircleCI pull-request builds, and overly broad GitHub and npm **OIDC trusted publishing** policies. The malware propagated by using stolen npm tokens to publish infected patch versions of additional packages and established persistence through developer tooling by planting `.vscode/tasks.json` entries with `"runOn": "folderOpen"` and `.claude/settings.json` `SessionStart` hooks, a technique compared to the earlier **PolinRider/TasksJacker** tradecraft. Maintainers released cleaned package versions, while defenders were urged to rotate credentials, review GitHub, npm, and cloud activity, harden OIDC publishing rules, pin dependencies, and hunt repositories for unauthorized `folderOpen` tasks and Claude hooks.
Jun 29, 2026
Attackers linked by multiple researchers to **TeamPCP** hijacked the npm maintainer account `atool` and used it to publish roughly **639 malicious versions across 323 packages**, heavily impacting Alibaba’s **`@antv/*`** ecosystem as well as packages such as `echarts-for-react`, `timeago.js`, and `size-sensor`. Reports said the malware executed through malicious `preinstall` hooks and an obfuscated Bun-based payload, stealing secrets from developer workstations and CI/CD systems including GitHub, npm, AWS, Kubernetes, Vault, SSH, Docker, and database credentials. The campaign also abused GitHub tokens to create attacker-controlled repositories for exfiltration, scraped GitHub Actions runner memory for plaintext secrets, and in some cases targeted trusted tooling including a briefly compromised **Nx Console** VS Code extension. Researchers said the operation was worm-like and self-propagating, using stolen npm tokens to tamper with and republish additional packages under legitimate maintainer identities, with the broader **Mini Shai-Hulud** activity now tracked across npm, PyPI, and Composer. The malware reportedly established persistence in developer environments through modified VS Code and Claude Code settings and OS-level services, while some reports warned it also attempted to forge valid **Sigstore/SLSA provenance** using stolen CI identities. In response, **npm invalidated all write-enabled granular access tokens that bypassed two-factor authentication** and introduced **Staged Publishing** in preview, but researchers warned that any machine or pipeline that installed affected versions should be treated as fully compromised and all reachable credentials rotated immediately.
Jun 29, 2026
A supply-chain attack hit the **Laravel-Lang** ecosystem after attackers rewrote Git tags across `laravel-lang/lang`, `laravel-lang/attributes`, `laravel-lang/http-statuses`, and related repositories, causing **233 tagged package versions** to resolve to malicious commits. Researchers said the attacker abused GitHub tags that pointed to forked commits rather than altering the visible upstream code, allowing poisoned releases to spread through Composer and Packagist; one report said roughly **700 GitHub repositories** were affected. Packagist removed the malicious versions and temporarily unlisted the impacted packages to stop further installs. The malicious packages added `src/helpers.php` through Composer's `autoload.files`, so code executed automatically when applications loaded `vendor/autoload.php` in common PHP workflows including Laravel, Symfony, PHPUnit, and CI runners. The payload contacted **`flipboxstudio.info`**, dropped follow-on malware, and stole secrets including cloud credentials, CI environment variables, developer tokens, SSH keys, browser passwords, cryptocurrency wallets, VPN data, and Windows-specific credentials before encrypting and exfiltrating the data and deleting artifacts to hinder forensics. Security firms urged organizations that installed affected packages after the compromise to treat those environments as breached, rotate all accessible secrets, inspect `composer.lock` files, monitor for suspicious outbound traffic, and rebuild compromised systems from known-good images.
Jun 29, 2026