Malicious JS Lifecycle Hooks Found Hiding Inside PHP Composer Packages

3 months ago by exakat to c/php

Socket exposes a clever cross-ecosystem supply chain attack targeting PHP packages by hiding a malicious JS postinstall backdoor inside package.json.

SavinDWhales 3 points 3 months ago

That website is malicious. First thing after loading: allow notifications?

Couldn't get past the cookie banner, so...

save

path: 0 23937875, hotness: undefined, score: 3, children: 0

exakat 1 point 3 months ago

Another source for this info: https://socket.dev/...

save

path: 0 23945696, hotness: undefined, score: 1, children: 0

LurkingLuddite -11 points 3 months ago

I mean if you're using php in 2026...

save

path: 0 23914590, hotness: undefined, score: -11, children: 3

greyscale 3 points 3 months ago

🤡👞

save

path: 0 23914590 23915666, hotness: undefined, score: 3, children: 2

LurkingLuddite -2 points 3 months ago

I didn't specify why. Interesting how defensive you clowns get, though glad to see you didn't forget your makeup.

save

path: 0 23914590 23915666 23926221, hotness: undefined, score: -2, children: 1

greyscale 1 point 3 months ago

Half the internet runs on PHP bro. It pays a lot of rent and mortgages.

The toolchain is less hellish than JS for sure.

Its a pragmatic choice and its very easy to disregard you and opinions when its indistinguishable from 2005 skiddy talk.

save

path: 0 23914590 23915666 23926221 23929047, hotness: undefined, score: 1, children: 0

php

@lemmy.world

namespace lemmy\php;

Welcome to the PHP community on Lemmy

#Rules:

1: Soon(TM)

#Helpful stuff:

#Common frameworks:

echo "Welcome";

go to feed...

php

@lemmy.world

namespace lemmy\php;

Welcome to the PHP community on Lemmy

#Rules:

1: Soon(TM)

#Helpful stuff:

#Common frameworks:

echo "Welcome";

go to feed...