Supply Chain Infiltration: 13 Malicious Packagist Packages Deliver Zero-Click iOS Spyware to Steal Crypto Seeds
Executive Summary
Application security researchers at Socket have identified a coordinated open-source supply chain attack involving 13 malicious PHP Composer packages distributed via the official Packagist repository (The Hacker News). Disguised as legitimate themes for the open-source OphimCMS platform, the poisoned libraries inject malicious JavaScript into movie and comic streaming websites. When visitors access these sites using unpatched Apple iPhones, the script triggers a multi-stage WebKit-to-kernel browser exploit chain designed to install persistent spyware and silently exfiltrate cryptocurrency wallet seed phrases and private keys.
Deep-Dive Technical Analysis
Multi-Tier Attack Lifecycle & WebKit Exploitation
The campaign demonstrates an advanced supply chain pivot where server-side library poisoning cascades directly into client-side mobile device exploitation:
1. Packagist Namespace Poisoning: Threat actors published 13 packages across five distinct vendor namespaces on Packagist, mimicking popular content management themes (such as OphimCMS streaming templates).
2. Server-Side JavaScript Injection: When web administrators install the trojanized Composer packages on their web servers, the backend PHP code dynamically injects obfuscated client-side JavaScript into all rendered public HTML templates.
3. Browser Fingerprinting & Redirection: The client-side script evaluates the visitor's User-Agent, screen resolution, and browser platform. Non-iOS traffic is routed through ad-fraud and gambling redirect networks, while iOS traffic is selected for high-value targeted exploitation.
4. WebKit-to-Kernel Exploit Delivery: For visitors browsing on vulnerable iOS versions, the script loads an exploit chain that targets known WebKit memory corruption vulnerabilities. After achieving arbitrary memory read/write within the mobile Safari renderer process, the exploit leverages a secondary kernel vulnerability to escape the WebKit sandbox and obtain elevated root privileges.
5. Crypto Wallet Seed Exfiltration: The dropped spyware scans local browser caches, mobile wallet local storage, and clipboard memory to identify 12- and 24-word BIP-39 mnemonic seed phrases, private keys, and session cookies, exfiltrating the harvested credentials to attacker-controlled staging infrastructure.
Threat Modeling for Developers & Web Administrators
This incident illustrates how vulnerabilities in third-party web themes can compromise end-user devices without requiring explicit user consent:
* Cascading Supply Chain Blast Radius: A single compromised server-side Composer library can weaponize an entire website, turning every visitor's mobile browser into an active target for drive-by zero-click malware delivery.
* Targeting Decentralized Finance (DeFi) Mobile Users: As mobile devices increasingly serve as primary cryptocurrency transaction signers, adversaries are targeting web-based vectors to harvest non-custodial wallet credentials directly from device memory.
Actionable Recommendations & Mitigations
1. Audit & Purge Malicious Composer Dependencies: Web administrators must review their composer.json and composer.lock files, immediately removing any references to unverified OphimCMS theme packages.
2. Enforce Hash-Locked Dependency Pinning: Mandate cryptographic hash verification for all third-party PHP packages and enforce automated software composition analysis (SCA) within deployment pipelines.
3. Keep Mobile Operating Systems Updated: End users must ensure Apple iOS and iPadOS devices are updated to the latest available software releases (including iOS 26.6.1 / 18.x security patches) to patch known WebKit and kernel vulnerabilities.
4. Store Cryptocurrency Seeds in Air-Gapped Cold Storage: Never store cryptocurrency recovery seed phrases in digital form, mobile photo libraries, or unencrypted clipboard buffers; utilize dedicated hardware wallets with passphrase protection.
________________
Sources & References: The Hacker News.