Packagist Supply Chain Attack Infects 8 Packages Using GitHub-Hosted Linux Malware

A coordinated supply-chain attack affected eight Packagist packages by adding package.json postinstall scripts that download a Linux binary from a GitHub Releases URL, save it to /tmp/.sshd, chmod it executable, and run it in the background; the payload or installer was also found across hundreds of GitHub files and placed in some GitHub Actions workflows, suggesting broader distribution and multiple execution paths. The second-stage binary is unavailable, but the installer enables remote code execution during installs or CI builds and has been removed from Packagist.