A well-known North Korean threat actor has been caught hiding malware inside a legitimate PHP package available through Packagist, the main package repository for PHP projects. <\/p>\n
The attack takes direct aim at software developers, disguising a dangerous payload as a routine configuration file. This kind of campaign blends in easily with normal development workflows, making it especially hard to detect before any damage is done.<\/p>\n
The threat group behind this attack is known as Famous Chollima, a North Korean state-sponsored hacking crew with a long history of targeting developers. <\/p>\n
They originally gained attention for sneaking operatives into companies as fake employees. More recently, they have turned that tactic around by creating fake job offers and developer tasks to trick engineers<\/a> into running malicious code on their own machines.<\/p>\n Security researchers at\u00a0Socket.dev\u00a0said in a report<\/a> shared with Cyber Security News (CSN) that they discovered malicious JavaScript hidden inside a file called\u00a0 The package itself belongs to a legitimate maintainer named Drew Roberts, suggesting either a branch-level compromise or a poisoned workflow injection rather than a wholly fabricated fake package.<\/a><\/p>\n The malware sits quietly inside what looks like a standard Tailwind CSS configuration file. The harmful code is tucked away far to the right of the screen, hidden behind a large block of blank space that keeps it invisible during casual code review. <\/p>\n Once that obfuscated code runs, it quietly transforms into a full JavaScript malware loader operating inside Node.js.<\/a><\/p>\n The fact that the malicious version is buried in a development branch is a telling sign. <\/p>\n Packagist dev versions require explicit installation commands, meaning victims would likely be directed to run a very specific command, the kind that fits naturally into a fake interview or developer onboarding task. <\/p>\n Famous Chollima appears to have designed this campaign to target one developer at a time rather than cause widespread, noisy infections.<\/a><\/p>\n The malicious loader inside\u00a0 Instead, it contacts public blockchain services, specifically TRON<\/a>, Aptos, and BNB Smart Chain, to pull down encrypted payload data stored inside blockchain transaction records. <\/p>\n This dead-drop method means there is no traditional command-and-control domain to block, making detection much harder for standard security tools.<\/p>\n The loader uses hardcoded XOR keys to decrypt the material it retrieves and then runs the result directly inside Node.js using\u00a0 It can also quietly launch a second hidden process in the background using\u00a0 The campaign marker\u00a0 The local loader does not directly steal files on its own, but the remote payload it fetches can access nearly everything on the victim\u2019s machine. <\/p>\n Once inside Node.js, the delivered malware can read environment variables holding cloud credentials and CI secrets, grab local files such as\u00a0 The real damage sits inside the payload retrieved from the blockchain, not in the visible code itself.<\/a><\/p>\n Developers should treat any unfamiliar build instruction received during a job interview or remote task as a potential code execution event. <\/p>\n Before running any unknown PHP or JavaScript project, manually inspect files like\u00a0 Security teams should watch for Node.js processes<\/a> connecting to blockchain or RPC services during build pipelines, and organizations should avoid exposing long-lived cloud credentials to branch-level builds. <\/p>\n Package consumers should always pin stable, known-good versions and avoid dev branches unless absolutely necessary. The affected Packagist version was reported and has since been removed following Socket\u2019s disclosure.<\/a><\/p>\n Indicators of Compromise (IoCs):-<\/strong><\/p>\ntailwind.js<\/code>, bundled with the Packagist development version\u00a0dev-drewroberts\/feature\/test-case<\/code>\u00a0of the PHP package\u00a0roberts\/leads<\/code>. <\/p>\nFamous Chollima Hackers Target PHP Developers<\/strong><\/h2>\n
tailwind.js<\/code>\u00a0does not work like ordinary malware that reaches out to a suspicious server. <\/p>\n![\"Packagist](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiU3KuZA_LLNR_ERix8h2K87rM63BQFP0oVa87I3RckmcFAZ6ue17huOUfTCPY88XUcXI_PAUoh5QkLqtCRjqTTe1WRYbNk643zkNegOZLRn3kMl25R7hv5nvyIkpP0rGh_iEi339Npa9rc5_-JwuEVLBNiQJbMey9-K0TnsWcPeGRXCzadKrMO8USHxOc\/s16000\/Packagist%2520listed%2520the%2520affected%2520roberts%2520-%2520leads%2520dev%2520branch%2520as%2520an%2520installable%2520version%2520%28Source%2520-%2520Socket.dev%29.webp?ssl=1\")
eval()<\/code>. <\/p>\nchild_process.spawn()<\/code>\u00a0with the\u00a0windowsHide<\/code>\u00a0flag set to true, keeping everything out of sight on Windows systems. <\/p>\nglobal['!']='9-0264-2'<\/code>\u00a0embedded in the code is a known identifier tied to prior Famous Chollima operations, linking this directly to malware families including DEV#POPPER RAT, OmniStealer, and BeaverTail payloads.<\/a><\/p>\nExfiltration Scope and What Developers Are at Risk<\/strong><\/h2>\n
.env<\/code>\u00a0files and SSH keys, access stored tokens, and run additional processes. <\/p>\ntailwind.js<\/code>,\u00a0webpack.mix.js<\/code>,\u00a0vite.config.*<\/code>,\u00a0postcss.config.*<\/code>, and\u00a0.github\/workflows<\/code>. <\/p>\n