Malicious Intercom PHP Package Spreads Mini Shai-Hulud Supply-Chain Attack to Packagist
Summary
A compromised intercom/intercom-php 5.0.2 artifact used a Composer plugin to download Bun and run credential-stealing malware during installation or updates. Packagist removed the artifact; affected users should investigate hosts and rotate exposed credentials.
Key points
- The compromised intercom/intercom-php 5.0.2 artifact was changed to point to malicious commits; Socket reported it to Packagist, which removed it.
- The package was altered into a Composer plugin that runs a shell script on install or update, downloads Bun, and launches an obfuscated JavaScript payload.
- The malware targets developer and CI/CD secrets, including GitHub and npm tokens, SSH keys, cloud credentials, Kubernetes and Vault tokens, and environment files.
- Stolen data is encrypted before exfiltration, with GitHub-based fallback exfiltration using stolen credentials.
- The payload includes capabilities to modify GitHub repositories and republish npm packages, enabling supply-chain propagation.
- Intercom said the compromise originated from a local installation of pyannote-audio, which pulled in the compromised PyPI lightning package; the affected installation was not tied to other repositories.
- Organizations that installed the artifact should check Composer logs and repositories, remove it, and rotate potentially exposed credentials.
Article Details
- Attack Vectors
- A modified intercom/intercom-php@5.0.2 artifact registered a Composer plugin that executed code during post-install and post-update events.
- The plugin ran setup-intercom.sh, which downloaded Bun 1.3.13 from GitHub Releases and launched the obfuscated router_runtime.js credential-stealing payload.
- The payload harvested developer, CI/CD, cloud, and application secrets; encrypted collected data; and attempted exfiltration to a hardcoded endpoint, with a GitHub-based fallback using stolen credentials.
- The payload included logic to use discovered npm tokens to modify and republish packages and to modify GitHub repositories with payload files.
- Defensive Notes
- Audit environments for installation of intercom/intercom-php@5.0.2 and review Composer logs for setup-intercom.sh or “Running Intercom setup script.”
- Check whether Composer plugin execution was allowed; remove the malicious artifact and reinstall only from a known-good source.
- Rotate potentially exposed credentials, including GitHub and npm tokens, SSH keys, cloud and Kubernetes credentials, Vault tokens, Docker registry credentials, and application secrets.
- Review GitHub repositories for unauthorized commits, workflow files, payload files under .claude/ or .vscode/, and suspicious public repositories; review npm packages controlled by affected maintainers for unauthorized releases or install-time changes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | zero[.]masscan[.]cloud | Domain for the payload's hardcoded exfiltration endpoint. |
| SHA256 | 50212a875643520353df158196b9b3be4595094125ad8d2d2c48bdd9cb04ce1f | SHA-256 hash of the credential-stealing router_runtime.js payload. |
| SHA256 | 66664a49edbcee0ed0d8365839707916e92d3aa06e7f26f33c9dcc58e5fc1ef3 | SHA-256 hash of the malicious intercom-intercom-php-5.0.2.zip artifact. |
| SHA256 | 832a976d1a8d54e296e8479aedbd89fa24baa02b8409a78bf06d4d03340881bd | SHA-256 hash of setup-intercom.sh in the malicious artifact. |
| SHA256 | 907aec5b1288057a3e0885226918b6930a62a0f348ce23de026a683238c7903e | SHA-256 hash of composer.json in the malicious artifact. |
| SHA256 | b084743bd16043461e68b604dde80a8b386b405eae6f66c1103fb4fd6831d4a7 | SHA-256 hash of src/composerPlugin.php in the malicious artifact. |
| URL | hxxps[:]//zero[.]masscan[.]cloud/v1/telemetry | Hardcoded exfiltration endpoint in the PHP payload. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes router_runtime.js as a heavily obfuscated JavaScript payload.T1041 · Exfiltration Over C2 ChannelThe payload encrypts stolen data and exfiltrates it to a hardcoded endpoint, with a GitHub-based fallback.T1195.002 · Compromise Software Supply ChainA compromised package artifact delivered malicious code through the intercom/intercom-php dependency.T1546.016 · Installer PackagesThe malicious Composer plugin executes code during post-install and post-update events.T1555 · Credentials from Password StoresThe payload collects credentials and secrets, including cloud credentials, tokens, SSH keys, and credentials in configuration files.
Malware
Vendors
Products
AWSAWS credentialsAzureAzure credentialsBunA malicious intercom/intercom-php package artifact uses Composer plugin execution to download Bun and run the same style of obfuscated credential-stealing payload observed in the ongoing Mini Shai-Hulud campaign.ComposerA malicious intercom/intercom-php package artifact uses Composer plugin execution to download Bun and run the same style of obfuscated credential-stealing payload observed in the ongoing Mini Shai-Hulud campaign.DockerDocker credentialsGCPGCP credentialsGitHubas a credential theft and supply chain propagation payload that harvests CI/CD and cloud secrets, abuses GitHub repositories for staged exfiltration, and uses daemonized execution to evade normal process visibility.HashiCorp VaultHashiCorp Vault tokensintercom-clientconnects the attack chain across three ecosystems: the PyPI lightning compromise led to the npm intercom-client compromise, which was then followed by the malicious Packagist artifact for intercom/intercom-php.intercom/intercom-phpA malicious intercom/intercom-php package artifact uses Composer plugin execution to download Bun and run the same style of obfuscated credential-stealing payload observed in the ongoing Mini Shai-Hulud campaign.Kubernetesrouter_runtime.js, downloaded Bun without integrity checks, and used an obfuscated payload to collect Kubernetes and Vault credentials, with stolen secrets encrypted and exfiltrated through GitHub infrastructure.npmThat finding connects the attack chain across three ecosystems: the PyPI lightning compromise led to the npm intercom-client compromise, which was then followed by the malicious Packagist artifact forPackagisthave reached high-value developer and CI/CD environments quickly. We reported the malicious artifact to Packagist, which quickly removed.PyPIpackage as a transitive dependency. That finding connects the attack chain across three ecosystems: the PyPI lightning compromise led to the npm intercom-client compromise, which was then followed by the malicious