Hackers Hide Linux Malware in SSH-Like Package Filename

Researchers uncovered a coordinated supply-chain campaign where attackers modified upstream GitHub repositories to add malicious post-install package.json scripts that download a Linux binary to /tmp/.sshd and execute it, affecting multiple Packagist packages (notably Laravel starter kits) and leveraging npm lifecycle scripts and CI workflows to maximize impact; Socket reported and had the packages removed, and IOCs include the GitHub account parikhpreyash4 and a release URL for the payload.