--- title: "Famous Chollima Targets PHP Developers Through Compromised P..." url: https://daily.dev/posts/famous-chollima-targets-php-developers-through-compromised-p--zloabwapj source_url: https://socket.dev/blog/famous-chollima-targets-php-developers-through-compromised-packagist-package type: article source: "Socket" published: 2026-05-31T22:33:33.714Z updated: 2026-05-31T22:34:07.243Z tags: ["security", "php", "malware"] reading_time: 7 upvotes: 0 comments: 1 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Famous Chollima Targets PHP Developers Through Compromised P... **[Socket](https://daily.dev/sources/socketdev)** · 7 min read · 0 upvotes · 1 comments ## Summary Socket Research has identified a North Korean APT (Famous Chollima) supply chain attack targeting PHP developers via a compromised dev branch of the legitimate Packagist package roberts/leads. Malicious obfuscated JavaScript was injected into tailwind.js in the dev-drewroberts/feature/test-case branch. The loader uses blockchain infrastructure (TRON, Aptos, BNB Smart Chain) as a dead-drop C2 mechanism to retrieve, decrypt via XOR, and execute remote payloads using eval() and hidden Node.js child processes. The attack pattern matches Contagious Interview-style lures where victims are socially engineered — typically through fake job interviews — into installing a specific dev branch. Prior campaigns using the same infrastructure delivered DEV#POPPER RAT, OmniStealer, and BeaverTail payloads. Developers are advised to inspect build config files before running unfamiliar projects, avoid untrusted dev branches, and restrict CI secret scopes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/famous-chollima-targets-php-developers-through-compromised-p--zloabwapj)