Mini Shai-Hulud in Intercom Package Spreads to Packagist Using Composer Plugin
intercom/intercom-php 5.0.2 was compromised and converted into a Composer plugin that exfiltrates credentials at install time, extending the Mini Shai-Hulud campaign to PHP.
Opening excerpt (first ~120 words) tap to expand
After compromising Lightning on PyPi earlier today, the same attackers compromised the intercom/intercom-php package version 5.0.2 on Packagist by overwriting the existing version with malicious code that converts it into a Composer plugin. The malicious plugin executes during package installation, downloading Bun JavaScript runtime and running an obfuscated credential-stealing payload. This represents an expansion of the Mini Shai-Hulud campaign from npm to the PHP ecosystem, using Composer's plugin system for install-time execution.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at Semgrep.
Discussion
0 commentsMore from Semgrep
