Composer and Packagist Introduce New Supply Chain Security Measures After PHP Ecosystem Attacks
By
Nils Adermann
Sesame, salt, and substance. A flagship bake.
Summary
Composer and Packagist.org are implementing new security measures to combat rising software supply chain attacks targeting the PHP open-source ecosystem. Following incidents where attackers used stolen GitHub tokens to publish malicious tags on packages like laravel-lang and intercom/intercom-php, the team is introducing features such as package submission rate limiting, tag signing verification, and improved credential monitoring. The post details ongoing work to harden the infrastructure against account takeovers and unauthorized package modifications.
Key quotes
· 3 pulledThe last months, and even more so the last weeks, saw an increasing amount of software supply chain attacks targeting open-source ecosystems.
A handful of these have hit the PHP ecosystem too, via taken-over GitHub accounts and stolen access tokens that let attackers publish new tags on packages they had no legitimate access to.
Most notably laravel-lang on May 22 and intercom/intercom-php on April 30th.
You might also wanna read
September 2025 NPM supply-chain attack compromises popular JavaScript packages
In September 2025, a coordinated software supply-chain attack targeted multiple popular NPM packages in the JavaScript ecosystem. The attack
AWS well-architected framework best practices for software supply chain security
This article discusses software supply chain security best practices in the context of recent npm Registry attacks (Shai-Hulud, Chalk/Debug,
aws.amazon.com·4d ago
Microsoft uncovers supply chain attack: Compromised @antv npm packages steal CI/CD credentials via Mini Shai-Hulud malware
Microsoft has identified an active supply chain attack targeting the @antv npm package ecosystem. A threat actor compromised an @antv mainta
Microsoft uncovers npm supply chain attack stealing cloud and CI/CD credentials via typosquatted packages
Microsoft identified an active supply chain attack (Mini Shai-Hulud campaign) targeting the npm package ecosystem. On May 28, 2026, a threat
North Korean Chollima Group Targets PHP Developers via Malicious Packagist Package
A malicious obfuscated JavaScript payload was discovered appended to tailwind.js in the Packagist development version dev-drewroberts/featur
socket.dev·5h ago
CISA warns security teams of wave of attacks targeting software supply chain credentials
CISA has issued a warning urging security teams to check for software development compromises, specifically regarding a wave of attacks targ
cybersecuritydive.com·18h ago