13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
- ID
- 20265
- Status
- summarized
- Published
- 01 Sep 2026, 10:07 PM
- Fetched
- 01 Sep 2026, 10:56 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/13-malicious-packagist-packages-target.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.5
- Created
- 01 Sep 2026, 10:58 PM
- Tags
- Audience
- developersdatabase_learners
What happened
Researchers identified 13 malicious Composer theme packages on Packagist across five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites. The injected code runs ad-fraud redirects and, on unpatched iPhones, triggers a WebKit-to-kernel exploit chain using CVE-2025-31277 and CVE-2025-43529 to install spyware that steals keychain databases, crypto wallet seeds, and other sensitive data.
Why it matters
If you ship PHP apps using Composer, audit your dependencies for any of the listed package names and verify that theme packages come from legitimate vendor namespaces. The attack shows that typosquatted or trojanized Packagist packages can turn your site into a delivery mechanism for zero-day iOS exploits—meaning your supply chain hygiene directly affects your visitors' device security, not just your own infrastructure.
Discussion angle
How many PHP/Composer users in the group actually vet theme packages before installing them, and would a Socket-style dependency scanner have caught this before deployment?