Poisoned Pipeline / Incidents / AS149

AS149 · 2026-06

Famous Chollima compromised Packagist package

Packagist / Composer

Socket: Famous Chollima (DPRK) targeted PHP developers through a
compromised Packagist package.

Mapped techniques

• T0121 Compromised legitimate artifact
• T0113 Compromised user account

supply-chain campaign

Sources

• https://socket.dev/blog/famous-chollima-targets-php-developers-through-compromised-packagist-package