2026-04-30 22:12 UTC
🚨 BREAKING: Mini Shai-Hulud has spread to Packagist. We detected a malicious intercom/intercom-php@5.0.2 package artifact tied to this campaign.
The compromised #PHP package used Composer plugin execution to run during install/update, download Bun, and launch an obfuscated router_runtime.js credential-stealing payload.
It targeted GitHub, npm, SSH, cloud, Kubernetes, Vault, Docker, .env files, and more.
We reported it to Packagist, which removed the malicious version.
https://socket.dev/blog/mini-shai-hulud-packagist-malicious-intercom-php-package-compromise
Replies (1)
-
@dbu@phpc.social 2026-05-01 12:55
@SocketSecurity@fosstodon.org thanks for reporting this. Composer plugins are only executed after giving permission by the user (unless the package already has been allowed for plugins, which seems not the case here according to your write-up). Is it correct that if the user did not allow composer to run the plugin, the malicious code has not been executed?