Packagist Supply Chain Attack Infects 8 Packages Using GitHub-Hosted Linux Malware

Key Points:

• A coordinated supply chain attack has compromised eight packages on Packagist, embedding malicious code that retrieves a Linux binary from a GitHub URL.
• The attack impacts projects using JavaScript build tooling alongside PHP, allowing the malware to evade detection by focusing on package.json instead of composer.json. This could lead to remote code execution during installation or build workflows.
• It is recommended to block the affected packages and monitor for any unauthorized modifications in package.json files. Security teams should also review GitHub Actions workflows for potential exploitation.

Technical Details: The malicious code modifies upstream repositories to include a postinstall script that downloads a binary from GitHub, saves it to "/tmp/.sshd", changes permissions with "chmod", and executes it in the background.

MITRE ATT&CK Techniques:

• T1203 - Exploit Public-Facing Application (Initial Access)
• T1059.003 - Command and Scripting Interpreter: Windows Command Shell (Execution)
• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)

IOCs Mentioned:

• github.com/parikhpreyash4/systemd-network-helper-aa5c751f