Fallout in php, Aug 31 – Sep 6

What we caught this week while monitoring over 163,052,840 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Sep 6 · 1 catch · 0 waves · 1 single
objectives/command-and-controlobjectiveswell-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/langobjectives/anti-staticobjectives/evasionthird-party+8 18d
leazycms/web v1.0.209 php 112 installs 18 days ago

obfuscated eval webshell in installer

PHP/GzinflatedVia/Get

WEDNESDAY

Wed Sep 2 · 2 catches · 0 waves · 2 singles
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/buildobjectives/anti-staticobjectives/executionobjectivesobjectives/impactwell-knownmicro-behaviors/ui+10 22d
yrodevgit/ctrx v5.6.5 php 490 installs ✓ 22 days ago

Embedded Russian regional malware payload

supply-chain/sweetalert2-protestwaremanipulation/browser
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/packagewell-known/libmicro-behaviors/dataobjectivesobjectives/impactwell-knownmicro-behaviors/ui+6 22d
gp247/front 3.0.1 php 1,026 installs ✓ 22 days ago

Malicious code in bundled JS

supply-chain/sweetalert2-protestwaremanipulation/browser

TUESDAY

Tue Sep 1 · 7 catches · 0 waves · 0 singles
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/buildobjectives/anti-staticobjectives/executionobjectivesobjectives/impactwell-knownmicro-behaviors/ui+10 23d
yrodevgit/ctrx v5.6 php and 6 siblings biggest campaign 481 installs ✓ 23 days ago

Supply chain sabotage in SweetAlert2

supply-chain/sweetalert2-protestwaremanipulation/browser

MONDAY

Mon Aug 31 · 3 catches · 0 waves · 3 singles
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/buildobjectives/anti-staticobjectives/executionobjectivesobjectives/impactwell-knownmicro-behaviors/ui+10 23d
yrodevgit/ctrx v5.5.5 php 479 installs ✓ 23 days ago

Malicious regional browser hijack code

manipulation/browsersupply-chain/sweetalert2-protestware
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/buildobjectives/anti-staticobjectives/executionobjectivesobjectives/impactwell-knownmicro-behaviors/ui+10 24d
yrodevgit/ctrx v5.5.4 php 476 installs ✓ 24 days ago

Embedded Russian regional malware payload

manipulation/browsersupply-chain/sweetalert2-protestware
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/executionobjectivesobjectives/impactwell-knownmicro-behaviors/ui+9 24d
yrodevgit/ctrx v5.5.3 php 476 installs ✓ 24 days ago

Embedded Russian-targeted sabotage payload

supply-chain/sweetalert2-protestwaremanipulation/browser
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories