🧰 Composer

The items that name it 17

• PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now
  advisoryas classification.technologies2026-10-22
• Package managers have an integrity problem
  writeupas classification.technologies2026-10-14
• Socket: FUNNULL iOS Spyware Campaign via 13 Malicious Packagist Themes
  writeupas classification.technologies2026-09-01
• The State of Open Source Supply Chain Attacks
  articleas classification.technologies2026-08-23
• Socket: PHP and Composer Support Reaches Beta With Reachability Analysis
  articleas tools2026-08-22

  PHP dependency manager; Socket analyzes composer.lock and composer.json files to resolve dependency trees

• Cloud Threat Highlights: H1 2026
  writeupas affected products2026-08-06

  Package ecosystem targeted in the supply-chain campaign wave.

• How Aikido Intel detects malware and vulnerabilities first
  articleas tools2026-07-13

  PHP package manager that stops downloads from Packagist when Intel flags a package as malicious.

• PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
  writeupas tools2026-07-08

  PHP package manager that resolves packages via GitHub webhook-triggered metadata updates and downloads a zipball of the tagged commit directly from GitHub.

• Packagist is now protected by Aikido Intel and other updates to the PHP registry
  articleas affected products2026-06-26

  Composer clients older than 2.10 do not have Aikido Intel-powered malware blocking

• npm v12 delivers one of the biggest security improvements in years
  articleas classification.technologies2026-06-11
• Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets
  writeupas tools2026-06-02

  PHP dependency manager exploited via the autoload.files map to achieve eager, automatic execution of the malicious src/helpers.php on every application boot

• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeupas classification.technologies2026-06-01
• Socket: Malicious Postinstall Hook Compromises 8 PHP/Node Packages on Packagist
  writeupas classification.technologies2026-05-23
• Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer
  writeupas tools2026-05-23

  PHP dependency manager whose autoloader feature was exploited to automatically load the malicious credential-stealing code

• Socket: Mini Shai-Hulud Hits @antv Ecosystem
  writeupas classification.technologies2026-05-20
• Socket: Packagist Urges Immediate Composer Update After GitHub Actions Token Leak
  advisoryas affected products2026-05-13
• shai-hulud-detect: multi-ecosystem npm/PyPI/Composer/Crates/Go/Hex/RubyGems supply-chain worm scanner
  repoas classification.technologies