PEAR installer served Perl backdoor

Linux distro / packages Installer / update channel

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

T0172 Runtime backdoor
T0184 Harvesting sensitive information from files
T0209 Compromise package registry or CDN origin

supply-chain campaign

T0172 · Execution · Runtime backdoor

Backdoor/RAT payload documented by the cited sources.

T0184 · Credential Access · Harvesting sensitive information from files

Credential or wallet material targeted.

T0209 · Initial Access · Compromise package registry or CDN origin

Distribution origin hosted the trojanized artifact.

Sources

https://blog.paranoidpenguin.net/2019/01/pear-php-net-probably-compromised/
https://twitter.com/pear/status/1086934578562560001
https://www.rapid7.com/blog/post/2019/01/22/php-extension-and-application-repository-pear-compromise-what-you-need-to-know/
https://www.cpanel.net/blog/products/when-php-went-pear-shaped-the-php-pear-compromise/
https://thephp.cc/articles/blast-from-the-past