North Korean Group Famous Chollima Compromises Packagist Package to Target PHP Developers
By
SocketDev
Master baker tier. Every paragraph earns its place on the tray.
Summary
A cybersecurity threat report detailing how the threat actor group "Famous Chollima" (linked to North Korea) targeted PHP developers by compromising a Packagist package called roberts/leads. A malicious obfuscated JavaScript loader was appended to tailwind.js in a dev branch (dev-drewroberts/feature/test-case), designed to infect developer environments and potentially enable supply chain attacks. The article highlights the growing trend of nation-state actors targeting open-source ecosystems to compromise downstream users.
Key quotes
· 3 pulledA malicious obfuscated JavaScript loader was discovered appended to tailwind.js in the Packagist dev version dev-drewroberts/feature/test-case of the roberts/leads package.
This appears to be tied to a compromised development branch rather than the main package release.
The attack targets PHP developers specifically, aiming to compromise their development environments and potentially inject malicious code into downstream projects.
You might also wanna read
North Korean Chollima Group Targets PHP Developers via Malicious Packagist Package
A malicious obfuscated JavaScript payload was discovered appended to tailwind.js in the Packagist development version dev-drewroberts/featur
socket.dev·12h ago
Microsoft uncovers supply chain attack: Compromised @antv npm packages steal CI/CD credentials via Mini Shai-Hulud malware
Microsoft has identified an active supply chain attack targeting the @antv npm package ecosystem. A threat actor compromised an @antv mainta
npm malware targeting Claude users leaks own GitHub token, reaches 676 downloads
An npm package called "mouse5212-super-formatter" targeting Claude users acted as information-stealing malware, reaching 676 downloads befor
theregister.com·2d ago
Attacker publishes 14 malicious npm packages impersonating OpenSearch and Elasticsearch libraries
A single npm user published 14 malicious packages over four hours, impersonating popular OpenSearch, Elasticsearch, DevOps, and environment-
briefly.co·2d ago
Extending Wazuh Detection with Clickdetect, OpenSearch PPL, and Sigma Rules
This blog post by "souzo" introduces clickdetect, a repository/tool designed to extend Wazuh's detection capabilities by integrating with Op
infosecwriteups.com·3d ago
FuzzingBrain V2: Multi-Agent LLM System Achieves 90% Vulnerability Detection Rate and Discovers 29 Zero-Day Flaws
FuzzingBrain V2 is a multi-agent LLM system for automated vulnerability discovery and reproduction in software. It addresses three key chall
arxiv.org·4d ago