Fallout in php, Aug 24 – Aug 30

What we caught this week while monitoring over 163,411,591 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Aug 30 · 4 catches · 0 waves · 3 singles
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/packagewell-known/libmicro-behaviors/dataobjectivesobjectives/impactwell-knownmicro-behaviors/ui+6 25d
gp247/front 3.0 php 1,015 installs ✓ 25 days ago

Malicious region-gated audio injection

supply-chain/sweetalert2-protestwaremanipulation/browser
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/executionobjectivesobjectives/impactwell-knownmicro-behaviors/ui+9 25d
yrodevgit/ctrx v5.5 php 472 installs ✓ 25 days ago

Region-gated UI suppression and audio loop

manipulation/browsersupply-chain/sweetalert2-protestware
objectivesobjectives/anti-staticmicro-behaviors/communicationsmicro-behaviorsmicro-behaviors/cryptomicro-behaviors/osmicro-behaviors/datamicro-behaviors/processmetadatathird-party 25d
taha20/license-client v1.0.1 php 7 installs 25 days ago

Encrypted eval obfuscation

Encoded/Big

SATURDAY

Sat Aug 29 · 1 catch · 0 waves · 1 single
well-known/libmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/packageobjectives/credential-accessmicro-behaviors/dataobjectivesobjectives/impactwell-knownmicro-behaviors/ui+6 26d
gp247/front 2.2 php 1,006 installs ✓ 26 days ago

Bundles protestware payload

manipulation/browserunwanted/sweetalert2-protestware

FRIDAY

Fri Aug 28 · 3 catches · 0 waves · 3 singles
well-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/langobjectives/anti-staticmicro-behaviors/dataobjectives/command-and-controlobjectivesthird-party+7 27d
leazycms/web v1.0.74 php 73 installs 27 days ago

Obfuscated eval webshell in installer

webshell/decoderVia/Get
well-known/libmicro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/command-and-controlobjectivesobjectives/impactwell-knownmicro-behaviors/ui+10 27d
yrodevgit/ctrx v5.4.9 php 464 installs ✓ 27 days ago

Bundled protestware disables browser

manipulation/browserunwanted/sweetalert2-protestware
well-known/libmicro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/discoveryobjectivesobjectives/impactwell-knownmicro-behaviors/ui+9 27d
yrodevgit/ctrx v5.4.6 php 464 installs ✓ 27 days ago

Bundled protestware disables UI, plays audio

manipulation/browserunwanted/sweetalert2-protestware

WEDNESDAY

Wed Aug 26 · 2 catches · 0 waves · 2 singles
well-known/libmicro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/command-and-controlobjectivesobjectives/impactwell-knownmicro-behaviors/ui+10 29d
yrodevgit/ctrx v5.4.5 php 445 installs ✓ 29 days ago

Bundled protestware disables browser

manipulation/browserunwanted/sweetalert2-protestware
well-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/langobjectives/anti-staticobjectives/executionobjectives/command-and-controlobjectivesthird_party+9 29d
leazycms/web v1.0.49 php 45 installs 29 days ago

Obfuscated eval webshell in installer

webshell/decoderGeneric/Callback

TUESDAY

Tue Aug 25 · 2 catches · 0 waves · 2 singles
well-known/libmicro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/command-and-controlobjectivesobjectives/impactwell-knownmicro-behaviors/ui+10 30d
yrodevgit/ctrx v5.4.1 php 444 installs ✓ 30 days ago

Bundled region-gated protestware payload

unwanted/sweetalert2-protestwaremanipulation/browser

MONDAY

Mon Aug 24 · 2 catches · 0 waves · 2 singles
well-known/librarymicro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/command-and-controlobjectivesobjectives/impactwell-knownmicro-behaviors/ui+10 31d
yrodevgit/ctrx v5.3.6 php 433 installs ✓ 31 days ago

Bundled protestware disables browser

unwanted/sweetalert2-protestwaremanipulation/browser
well-known/libmicro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/command-and-controlobjectivesobjectives/impactwell-knownmicro-behaviors/ui+10 31d
yrodevgit/ctrx v5.3.7 php 433 installs ✓ 31 days ago

Bundled protestware disables browser

manipulation/browserunwanted/sweetalert2-protestware
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories