🧰 Packagist

The items that name it 22

• Evolution of Web3 in Cloud Supply Chain Attacks
  articleas affected products2026-10-07
• PolinRider Spreads Through Compromised GitHub Accounts and Packagist
  articleas classification.technologies2026-09-17
• Socket: FUNNULL iOS Spyware Campaign via 13 Malicious Packagist Themes
  writeupas classification.technologies2026-09-01
• Shai-Hulud was the best thing to happen to supply chain security
  articleas classification.technologies2026-08-24
• Socket: PHP and Composer Support Reaches Beta With Reachability Analysis
  articleas tools2026-08-22

  PHP package repository continuously monitored by Socket for malicious code and compromised releases

• PolinRider Caused Dozens of npm, Go, PHP Compromises
  writeupas classification.technologies2026-07-31
• Socket: GitHub Actions Abuse Powers Distributed cPanel/WHM Exploitation Campaign
  writeupas affected products2026-07-23

  PHP package repository that automatically synchronized ten malicious development versions of packages associated with compromised developer dinushchathurya, each containing 55-62 malicious GitHub Actions workflow files (583 total).

• ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
  writeupas affected products2026-07-17

  Ecosystem PolinRider spread into

• Socket: Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Music Scraping
  articleas affected products2026-07-17

  Hit by the Mini Shai-Hulud variant in April and May 2026.

• How Aikido Intel detects malware and vulnerabilities first
  articleas affected products2026-07-13It is written here as Packagist (PHP registry).

  Protected by Aikido Intel; all downloads via Composer are checked against the Intel database.

• The OpenSourceMalware Show #12
  talkas affected products2026-07-09It is written here as Packagist (PHP).

  Package registry that PolinRider campaign jumped into, since it ships packages directly from GitHub repos without the additional authentication used by npm/PyPI.

• PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
  writeupas classification.technologies2026-07-08
• Socket: PolinRider
  writeupas classification.technologies2026-07-02
• Packagist is now protected by Aikido Intel and other updates to the PHP registry
  articleas classification.technologies2026-06-26
• Active Malware Campaigns in January-May 2026
  writeupas classification.technologies2026-06-08
• Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets
  writeupas tools2026-06-02

  Composer package mirror; retains original pre-compromise tarballs/dist that can be used for recovery, and can be notified to flag or yank affected versions

• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeupas tools2026-06-01

  PHP package registry hosting the compromised dev version of roberts/leads; Socket reported the affected version to Packagist's security team

• Socket: Malicious Postinstall Hook Compromises 8 PHP/Node Packages on Packagist
  writeupas tools2026-05-23

  PHP package registry; removed the affected packages after Socket's report and temporarily deleted affected branch-tracking package entries

• Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer
  writeupas tools2026-05-23

  PHP package registry that took down the malicious versions and temporarily unlisted the affected packages after being notified

• Socket: TeamPCP + BreachForums Launch $1,000 Contest for Supply Chain Attacks
  articleas affected products2026-05-20

  Open source package ecosystem targeted by TeamPCP

• Socket: Packagist Urges Immediate Composer Update After GitHub Actions Token Leak
  advisoryas tools2026-05-13

  PHP package registry that issued the urgent update warning

• Socket: pnpm 11 Adds Supply Chain Protection Defaults
  articleas affected products2026-05-07

  Ecosystem affected by the Mini Shai-Hulud supply chain campaign.