Fallout in php, Aug 17 – Aug 23

What we caught this week while monitoring over 163,411,591 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Aug 23 · 1 catch · 0 waves · 1 single
well-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticmicro-behaviors/datamicro-behaviors/fsmicro-behaviors/osmicro-behaviors/uiobjectives/command-and-controlobjectives+5 32d
leazycms/web v1.0.33 php 63 installs 32 days ago

obfuscated eval backdoor in installer

webshell/decoderwebshell/obf-dispatch

SATURDAY

Sat Aug 22 · 1 catch · 0 waves · 1 single
well-known/libmicro-behaviors/communicationsmicro-behaviorsobjectives/credential-accessmicro-behaviors/datamicro-behaviors/fsmicro-behaviors/osobjectivesobjectives/impactwell-knownmicro-behaviors/ui+5 33d
gp247/front 2.0.16 php 981 installs ✓ 33 days ago

Bundled SweetAlert2 protestware payload

manipulation/browserunwanted/sweetalert2-protestware

FRIDAY

Fri Aug 21 · 1 catch · 0 waves · 1 single
objectivesobjectives/credential-accesswell-knownwell-known/appmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/buildwell-known/toolsmicro-behaviors/datamicro-behaviors/fs+6 34d
alle80/griglia v0.69.0 php 34 days ago

vite dependency contains concealed native sidecar

depends on hostile npm: vite v8.2.1

MONDAY

Mon Aug 17 · 2 catches · 0 waves · 2 singles
well-known/libmicro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/command-and-controlobjectivesobjectives/impactwell-knownmicro-behaviors/ui+10 38d
yrodevgit/ctrx v5.0 php 384 installs 38 days ago

Bundled protestware disables browser

manipulation/browserunwanted/sweetalert2-protestware
well-knownwell-known/libmicro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/collectionobjectives/executionobjectivesobjectives/persistenceobjectives/supply-chain+11 38d
dixipro/magicpro v1.10.2 php 43 installs 38 days ago

JavaScript hides PHP eval backdoor

hidden-payload/trojancron/job
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories