Threats · 115 days ago
Composer reviews can look clean and still miss code execution. The break is that the payload sits in package.json, so PHP-only dependency checks do not see a JavaScript postinstall hook that runs at build time.
Socket says eight Composer packages were altered this way, and the same malicious script showed up across more than 700 GitHub repositories. The script downloaded a Linux binary, wrote it to /tmp/.sshd, made it executable, and ran it in the background.
The risk is not limited to the named packages. Any repo that pulled the tampered versions from GitHub or Packagist and then executed install hooks may have run attacker code, leaving a hidden build artifact rather than an obvious source change.
1 source covering this story
Malicious Postinstall Hook Found Across 700+ GitHub Reposito...
Socket found a malicious postinstall hook across 700+ GitHub repos, including PHP packages on Packagist and Node.js project repositories.
Part of the PlainSec briefing for 2026-05-23