🧰 roberts/leads

The items that name it 2

• PolinRider Caused Dozens of npm, Go, PHP Compromises
  writeup2026-07-31

  Compromised package discovered by Socket in May, sharing C2 infrastructure (23.27.202.27:443/:27017) with the PolinRider campaign; maintainer likely compromised via fake interview lure.

• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeup2026-06-01

  Legitimate Laravel package on Packagist compromised via a dev branch; maintainer Drew Roberts