1
Threat Overview
A coordinated supply chain attack campaign has impacted eight Composer packages on Packagist, injecting malicious code into package.json files to retrieve and run Linux binaries from GitHub Releases URLs, targeting projects that ship JavaScript. The attack affects projects using these packages. The attack vector is a code injection vulnerability.
2
Key Intelligence Points
1. Malicious code injected into package.json files to retrieve and run Linux binaries from GitHub Releases URLs. 2. Eight Composer packages on Packagist affected, targeting projects that ship JavaScript. 3. Attack chain involves retrieving Linux binaries from GitHub Releases URLs and executing them. 4. Detection opportunity: monitoring for suspicious GitHub Releases URL access and Linux binary execution.
3
MITRE ATT&CK Techniques
T1204.001 User Execution of Malicious Code via GitHub Releases URL
4
Indicators of Compromise (IOCs) / Affected Systems
GitHub Releases URL, Linux binary filenames, affected package versions
5
Mitigation & Detection
Update affected packages to the latest version, monitor for suspicious GitHub Releases URL access and Linux binary execution, and implement a web application firewall to block malicious GitHub Releases URL access.