Poisoned Pipeline / Incidents / AS52
Packagist CMS themes delivering iOS spyware
Packagist / ComposerCDN / web assets
Socket found 13 malicious Composer theme packages on Packagist (five
vendor namespaces used by Vietnamese OphimCMS/KKPhim movie sites). The
theme injects JS into every page: mobile ad-fraud plus, on iPhones, a
WebKit-to-kernel exploit chain (FUNNULL) that installs spyware and
steals crypto-wallet seeds. Apple said the kernel escape was already
fixed in iOS/macOS 26.1; WebKit bugs were in CISA KEV. Site operators
install with composer require.
Mapped techniques
- T0109 Publish malicious artifact
- T0121 Compromised legitimate artifact
- T0119 Cross-site scripting
- T0201 Customers compromised
supply-chain Packagist themes
Thirteen themes across vsmov, vsphim, haiau009, chilltvcms, ophimcms.
Themes for real Laravel CMS stacks.
Injected JS on every page of sites that installed the theme.
Site visitors (especially unpatched iPhones), not only the operator’s build.