The Worm Turns to PHP: Mini Shai-Hulud’s 20-Million-Install Hijack of Intercom

Socket researchers uncovered the "Mini Shai-Hulud" supply-chain campaign that compromised intercom/intercom-php on Packagist (v5.0.2), abusing Composer's plugin mechanism to run install-time scripts that download a JavaScript runtime and execute an obfuscated router_runtime.js payload which steals cloud credentials, developer secrets, environment files, and exfiltrates them to zero.masscan.cloud; any build using the malicious artifact on April 30, 2026 should be treated as compromised and follow recommended remediation (audit, remove artifact, rotate credentials, inspect repositories).