North Korean Chollima Group Targets PHP Developers via Malicious Packagist Package

Summary

A malicious obfuscated JavaScript payload was discovered appended to tailwind.js in the Packagist development version dev-drewroberts/feature/test-case of the legitimate PHP Laravel package roberts/leads. The malware, flagged by Socket AI Scanner, is attributed to the North Korean threat group Chollima and operates as a loader that fetches and executes remote code. The malicious code is isolated to a specific development branch exposed through Packagist, and the attack follows a Contagious Interview-style social engineering lure targeting PHP developers.