Malicious Packagist Themes Target Vietnamese OphimCMS Sites with Trojanized JS

Socket’s Threat Research Team discovered six trojanized Packagist packages published under the ophimcms namespace that target Vietnamese OphimCMS streaming sites; the malicious themes include trojanized JavaScript (disguised as jQuery) that exfiltrates browsing history to userstat.net, injects ads, hijacks clicks, and redirects mobile users to gambling/adult sites, with ~2,750 installs and a noted second-stage payload hosted by infrastructure linked to OFAC‑sanctioned FUNNULL Technology Inc.