13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

Attackers published 13 malicious Composer packages on Packagist — a trusted PHP dependency registry — to inject JavaScript into Vietnamese streaming sites, demonstrating how supply chain compromise can weaponize developer ecosystems against end users. The injected scripts exploited unpatched WebKit vulnerabilities on iOS devices, enabling theft of cryptocurrency wallet seed phrases, which permanently compromises a victim's funds with no recovery path. This campaign highlights the dual risk of unvetted open-source dependencies and delayed mobile OS patching, where either failure alone creates an exploitable gap. The combination of supply chain infiltration and client-side exploitation underscores that defending users requires both securing the software pipeline and maintaining up-to-date device firmware.