PHP Dependency Reviews Miss Cross-Ecosystem Install-Time Payloads
Composer reviews can look clean and still miss code execution. The break is that the payload sits in package.json, so PHP-only dependency checks do not see a JavaScript postinstall hook that runs at build time.
Socket says eight Composer packages were altered this way, and the same malicious script showed up across more than 700 GitHub repositories. The script downloaded a Linux binary, wrote it to /tmp/.sshd, made it executable, and ran it in the background.
The risk is not limited to the named packages. Any repo that pulled the tampered versions from GitHub or Packagist and then executed install hooks may have run attacker code, leaving a hidden build artifact rather than an obvious source change.