Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package

What it is

A JavaScript malware loader appended to tailwind.js in the Packagist dev version dev-drewroberts/feature/test-case of the legitimate Laravel package roberts/leads (maintainer: Drew Roberts). Socket attributes it to North Korean group Famous Chollima and assesses it as a developer/repo compromise or poisoned-branch workflow — not a package built from scratch. The stable release line did not show the same indicators.

How it works

The payload is concealed after the valid Tailwind config, pushed far right behind a large whitespace gap so it is easy to miss in review. Everything after the closing }; is the obfuscated loader. It reconstructs require and module via global aliases, then uses a two-stage, blockchain-as-dead-drop retrieval: a TRON trongrid.io account-transactions call returns data used as a payload pointer (reversed hex string), falling back to Aptos aptoslabs.com if TRON fails; that pointer (a BNB Smart Chain tx hash) is resolved via BSC RPC to fetch encrypted transaction input data, which is XOR-decrypted with a hardcoded key.

• First stage: decrypted and run with eval() in-process.
• Second stage: launched via child_process.spawn("node", ["-e", ...]) as a detached, windowsHide: true, stdio: "ignore" process.

Because the second-stage payload lives on-chain, the actor can rotate it without touching the package.

Preconditions / Affected

You must have installed the specific dev branch version dev-drewroberts/feature/test-case of roberts/leads. A normal stable install of the package was not flagged. Node.js execution of the tailwind.js config is what triggers the loader.

What to do

Check installs for the poisoned branch, then hunt for these indicators the page provides:

• Campaign markers: global['!']='9-0264-2' expanding to global['_V']='A9-0264-2'.
• TRON wallets used as pointers: TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG.
• Aptos fallback / BSC tx-hash arguments: 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e and 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3.
• XOR keys: 2[gWfGj;<:-93Z^C and m6:tTh^D)cBz?NM].
• Outbound calls to api.trongrid.io, fullnode.mainnet.aptoslabs.com, and BSC RPC from a build/dev context.
• Config files (e.g. tailwind.js) with trailing code after a large whitespace gap.

Socket reported the version to Packagist, notified the maintainer via GitHub and the listed security email, and flagged the file to GitHub Security.

Caveats

Attribution is an assessment ("we assess," "likely," "may have been intended"), not confirmed. The loader logic shown is a shortened, defanged excerpt, so it is not a complete IOC set. Socket says the stable line did not show indicators "in our review" — absence, not a guarantee.