---
title: "Malicious Postinstall Hook Found Across 700+ GitHub Reposito..."
url: https://daily.dev/posts/malicious-postinstall-hook-found-across-700-github-reposito--a4oaimw4h
source_url: https://socket.dev/blog/malicious-postinstall-hook-found-across-700-github-repos
type: article
source: "Socket"
published: 2026-05-22T22:28:02.252Z
updated: 2026-05-22T22:28:27.803Z
tags: ["security", "github-actions", "npm"]
reading_time: 7
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Malicious Postinstall Hook Found Across 700+ GitHub Reposito...

**[Socket](https://daily.dev/sources/socketdev)** · 7 min read · 0 upvotes · 0 comments

## Summary

Socket researchers uncovered a coordinated supply chain attack affecting eight Composer packages on Packagist. The attacker injected a malicious postinstall hook into package.json files (not composer.json) within upstream GitHub repositories, causing the payload to be distributed via branch-tracking package versions. The script downloads a Linux binary from an attacker-controlled GitHub Releases URL, saves it to /tmp/.sshd, and executes it in the background with TLS verification disabled. The same payload was also found in GitHub Actions workflow files across hundreds of public repositories. The most impactful packages are devdojo/wave and devdojo/genesis, popular Laravel starter kits. Socket reported the findings to Packagist, which removed the affected packages. Defenders are advised to inspect bundled package.json files in PHP projects, not just composer.json.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://socket.dev/blog/malicious-postinstall-hook-found-across-700-github-repos>

---

Tags: [#security](https://daily.dev/tags/security), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm)

[View this post on daily.dev](https://daily.dev/posts/malicious-postinstall-hook-found-across-700-github-reposito--a4oaimw4h)