Malicious Code Injected into Popular PHP Package via Compromised GitHub Accounts
The PolinRider campaign demonstrates a classic software supply chain attack: adversaries compromised developer accounts on GitHub and used that access to inject malicious payloads into a widely-used PHP package (visanduma/nova-two-factor) with over 700,000 cumulative downloads. By rewriting Git history and concealing payloads within development branches, attackers ensured that downstream consumers unknowingly pulled compromised code into their own projects. This matters because developers inherently trust packages from established repositories like Packagist, making supply chain poisoning an extremely high-leverage attack vector. The campaign's goals — cryptocurrency theft and credential harvesting — show that even niche open-source packages can become a gateway to serious financial and data loss across thousands of dependent organizations.
Tactical Insight
Immediate actions
- Audit all dependencies for the compromised package (visanduma/nova-two-factor) and roll back to a known-good version or remove it entirely.
- Enable multi-factor authentication (MFA) on all GitHub and Packagist developer accounts to prevent account takeover.
- Review recent Git commit history on your own repositories for unexpected changes, especially history rewrites or new branches.
Long-term improvements
- Implement a software composition analysis (SCA) tool in your CI/CD pipeline to automatically flag newly introduced or modified open-source dependencies.
- Pin all third-party package versions using lock files (e.g., composer.lock) and enforce cryptographic hash verification before installation.
- Establish a formal third-party dependency review process that evaluates the security posture of maintainers before adoption.
Detection measures
- Monitor package registries (Packagist, npm, PyPI) for unexpected version changes or ownership transfers on packages your organization consumes.
- Set up alerts for anomalous Git activity such as force-pushes, branch deletions, or history rewrites in repositories your teams depend on.
- Integrate runtime behavioral monitoring to detect cryptocurrency mining or unexpected network egress from application servers.