Socket researchers uncovered a coordinated supply chain attack affecting eight Composer packages on Packagist. The attacker injected a malicious postinstall hook into package.json files (not composer.json) within upstream GitHub repositories, causing the payload to be distributed via branch-tracking package versions. The script downloads a Linux binary from an attacker-controlled GitHub Releases URL, saves it to /tmp/.sshd, and executes it in the background with TLS verification disabled. The same payload was also found in GitHub Actions workflow files across hundreds of public repositories. The most impactful packages are devdojo/wave and devdojo/genesis, popular Laravel starter kits. Socket reported the findings to Packagist, which removed the affected packages. Defenders are advised to inspect bundled package.json files in PHP projects, not just composer.json.
