Supply chain attack compromises 8 Packagist packages with malicious binary

Affected Systems

Eight Composer packages on Packagist containing JavaScript components. Malicious code injected into package.json files executes a Linux binary from GitHub Releases. Downstream projects using these packages are affected.

Exploitation Status

Active exploitation confirmed. Malicious code deployed in production packages on Packagist, automatically executing during package installation or build processes.

Business Impact

Organizations using affected Packagist packages face immediate compromise risk. The malicious binary executes during Composer install or npm/yarn operations, potentially granting attackers code execution on developer workstations, CI/CD pipelines, and production servers. Supply chain attacks have high blast radius as compromised packages propagate to all downstream consumers. Specific package names not provided in report, hindering identification efforts.

Urgency

🔴 Immediate

Recommended Actions

• Audit all Composer dependencies for unexpected package.json files or post-install scripts executing external binaries
• Review Composer and npm/yarn install logs for connections to GitHub Releases or suspicious binary downloads
• Implement integrity checks using Composer lock files and verify package checksums against known-good versions
• Isolate build and CI/CD environments from production networks to limit lateral movement if compromised
• Monitor outbound network connections from development and build systems for unexpected GitHub or external binary downloads