Eight Packagist Projects Hijacked to Pull Linux Payload From GitHub Releases

Eight packages on Packagist, the registry that backs the PHP dependency manager Composer, were modified to fetch and execute a Linux binary hosted on a GitHub Releases URL, according to research published by Socket on November 17. The campaign is being described as coordinated rather than opportunistic, with the same retrieval logic appearing across each compromised project.

The placement of the malicious code is the unusual part. "Although the affected packages were all Composer packages, the malicious code was not added to composer.json," Socket wrote. "Instead, it was inserted into package.json, targeting projects that ship JavaScript." The choice of file matters: a developer auditing a Composer dependency would, by convention, look at composer.json first, and a malicious postinstall hook in package.json would not surface in that review.

The payload itself is a Linux ELF binary pulled from a GitHub Releases endpoint at install time. Hosting the second-stage on GitHub Releases lets the operator separate the loader, which is what defenders see during a package audit, from the executable, which can be rotated or removed without touching the registry entry. It also means the request to fetch the binary blends into ordinary developer traffic.

Packagist itself was not breached. The compromise sits at the maintainer-account layer, the same class of incident that has affected npm packages including chalk and debug earlier this year. Composer's design assumes the registry serves a manifest of record; when a maintainer pushes a manifest that quietly references a different ecosystem's tooling, the trust model bends in a way the specification does not directly address.

There is no CVE assigned to the campaign, which is consistent with how registry abuse is generally tracked. The eight affected packages have been removed or reverted, and Socket has published the list along with the GitHub Releases URL used for retrieval. Organisations that installed any of the affected versions should treat the affected build hosts as suspect and rotate any credentials accessible from those environments.

And the procedural piece. The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a specific advisory on this campaign, but its Secure Software Development Attestation Form, required of federal software suppliers, asks vendors to attest that they monitor third-party components for tampering. Suppliers whose builds pulled the affected packages during the exposure window will need to document the remediation in their next attestation cycle. Composer maintainers are expected to publish updated guidance on cross-manifest install hooks in the coming weeks.

The loader was small. The trust assumption it exploited was not.