# Packagist Supply Chain Attack: 8 Packages Deliver Linux Malware

> Security researchers identified a supply chain attack on Packagist involving eight infected packages that deploy Linux malware via GitHub Releases URLs.

- Published: 2026-05-23T20:22:18.000Z
- Severity: high
- Category: Supply Chain
- Tags: Packagist, Composer, Linux Malware, Supply Chain Attack, GitHub
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/05/packagist-supply-chain-attack-infects-8.html
- Canonical: https://runtimerebel.com/blog/packagist-supply-chain-attack-8-packages-deliver-linux-malware

## Key points

- Attackers compromised eight Packagist packages to distribute Linux malware through malicious scripts embedded in package.json files.
- PHP projects using Composer that also integrate JavaScript dependencies are vulnerable if they include the specific infected packages.
- Organizations should audit all dependency manifests and restrict network access from build environments to unauthorized GitHub Release URLs.

A sophisticated and coordinated [Supply Chain Attack](/glossary#supply-chain-attack) has targeted the PHP ecosystem, compromising eight different packages on Packagist to distribute Linux-based malware. According to [The Hacker News](https://thehackernews.com/2026/05/packagist-supply-chain-attack-infects-8.html), the campaign utilized a novel [TTP](/glossary#ttp) by hiding malicious logic within a file that PHP developers often overlook: the `package.json` file.

While the affected components are primarily known as Composer packages, the threat actors chose not to modify the `composer.json` manifest. Instead, they embedded malicious scripts into the `package.json` file, specifically targeting hybrid environments where JavaScript and PHP coexist. This strategy exploits the common practice of including JavaScript dependencies within PHP projects to manage front-end assets, increasing the likelihood that the malicious code remains undetected during standard security reviews.

### Packagist package.json malware analysis

The technical execution of this attack involves the use of the `postinstall` or similar lifecycle scripts within the `package.json` manifest. When a developer or an automated build system installs the compromised package, the malicious script triggers an [RCE](/glossary#rce) event by executing shell commands on the host system. The primary goal of these scripts is to download a malicious Linux binary from a GitHub Releases URL.

By leveraging GitHub as a delivery mechanism, the attackers bypass many basic egress filters that might otherwise block connections to known [C2](/glossary#c2) domains. The downloaded binary is designed to run on Linux environments, which are the predominant operating systems for web servers and CI/CD pipelines. Research from Socket indicates that the binary facilitates unauthorized access and potentially data exfiltration, though the full extent of the malware's capabilities is still under investigation. No [CVE](/glossary#cve) has been assigned to this specific campaign at this time, making detection reliant on behavioral analysis.

### How to detect Packagist supply chain attack

Security teams and [SOC](/glossary#soc) analysts can identify this threat by monitoring for unusual outbound network traffic originating from build servers or developer workstations. Specifically, any automated process that invokes `curl` or `wget` to retrieve executable files from GitHub Release pages should be treated as a high-fidelity [IoC](/glossary#ioc). 

Furthermore, defenders should implement file integrity monitoring for all manifest files in a repository. Because the attack spans across language ecosystems—using a JavaScript manifest to compromise a PHP project—security tools must be configured to scan all available configuration files regardless of the primary language of the repository. Deploying a modern [EDR](/glossary#edr) solution can also help identify the execution of the unauthorized Linux binary once it has been downloaded to the host.

### Malicious Composer packages mitigation

To effectively implement a **malicious Composer packages mitigation** strategy, organizations must move toward a [Zero Trust](/glossary#zero-trust) model for their software dependencies. This includes pinning versions of all packages and utilizing vendor directories to lock in known-good code. 

Defenders should prioritize the following actions:
- Audit all PHP projects for the presence of `package.json` files and verify the legitimacy of any defined scripts.
- Restrict build environments from accessing the internet, or use an allow-list to limit access to only necessary package registries.
- Use software composition analysis (SCA) tools that provide deep visibility into sub-dependencies and multi-language environments.

**Related:** [GitHub Repository Breach: 3,800 Repos Accessed via VS Code Extension](/blog/github-repository-breach-3800-repos-accessed-via-vs-code-extension), [Malicious GitHub OpenClaw Deployer Repos Deliver Trojans](/blog/malicious-github-openclaw-deployer-repos-deliver-trojans)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/packagist-supply-chain-attack-8-packages-deliver-linux-malware