TLDR Tech / InfoSec
Malicious Intercom PHP Package Spreads Mini Shai-Hulud Attack to Packagist via Composer Plugin
Attackers overwrote intercom/intercom-php 5.0.2 on Packagist with a malicious Composer plugin that executes at install time, downloading the Bun runtime and an obfuscated payload that exfiltrates GitHub tokens, SSH keys, cloud credentials, and environment variables to zero.masscan.cloud. The campaign extends the Mini Shai-Hulud attack from npm (where intercom-client 7.0.4 was hit via a preinstall hook earlier the same day) to PHP, abusing Packagist's webhook-driven reindexing model, which lacks a pre-publish quarantine. Defenders should pin versions, audit composer.lock for the malicious release, hunt for IOCs including setup-intercom.sh, router_runtime.js, src/composerPlugin.php, and .claude/.vscode artifacts, and rotate any credentials exposed on machines that ran composer install or update since the compromise.
Read the full story