[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fa3904quxfrxyyUxZvXUL44ahLMJdfmmLvYzXG2tEXIo":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"30f4a021-57c9-4c4c-ac6e-3976d955f277","13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds","13-malicious-packagist-packages-target-unpatched-iphones-to-steal-crypto-wallet--2e1433","Cybersecurity researchers have identified a set of 13 malicious Composer theme packages on Packagist that are designed to inject JavaScript into Vietnamese movie and comic streaming sites that install those libraries and initiate the deployment of spyware aimed at unpatched iOS devices. \"The injected code runs two operations against a site's visitors: a mobile ad-fraud and gambling-redirect","Cybersecurity researchers discovered 13 malicious Composer packages on Packagist that inject JavaScript into Vietnamese streaming sites. These packages deploy spyware targeting unpatched iOS devices, aiming to steal cryptocurrency wallet seeds by exploiting WebKit vulnerabilities. The campaign, active since March 2026, also includes mobile ad-fraud and gambling redirects.","13 malicious Packagist packages inject spyware to steal crypto wallet seeds from unpatched iPhones.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002F13-malicious-packagist-packages-target.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhB8expOvrNoEO7Mb5MSWWRnW2eVksJz4NGRldHmcBuWZ76ojuMDD6HJk_i043g-KHOi2zjcYQtsvYGXL2lyzPNy-vwRTD5jzMz5qdEXwfvYqt9K1Uu0Z5fpEMV2EVh9Ap0JRUD391nDM_TjgEXXGnI_dHRpxwv1H5VLiyQN4F3LBpRaEnmtbmCqdllIob2\u002Fs1600\u002Fiphone.jpg","2026-09-01T14:07:20+00:00","2026-09-01T16:00:11.155667+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"Composer","product",{"name":21,"type":19},"OphimCMS",{"name":23,"type":19},"iOS",{"name":25,"type":26},"WebKit","technology",{"name":28,"type":26},"JavaScript",{"name":30,"type":31},"Funnull","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"cve","CVE-2025-31277","Exploited WebKit vulnerability (patched in iOS 18.6)",{"type":57,"value":61,"context":62},"CVE-2025-43529","Exploited WebKit vulnerability (patched in iOS 18.7.3 and 26.2)",[30,18,21],{"controls":65,"vendors":150},[66,95,123],{"slug":67,"name":68,"problem":69,"products":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":54,"name":96,"problem":97,"products":98},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"slug":124,"name":125,"problem":126,"products":127},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[128,136,142],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":137,"product_name":138,"url":140,"description":141},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[151,157],{"slug":152,"name":153,"logo_path":154,"roles":155},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[156],"affected",{"slug":137,"name":138,"logo_path":139,"roles":158},[159],"reported_by",{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":176},"malicious-packagist-packages-exploit-unpatched-ios-webkit-to-steal-crypto-seeds","Malicious Packagist Packages Exploit Unpatched iOS WebKit to Steal Crypto Seeds","Attackers published 13 malicious Composer packages on Packagist — a trusted PHP dependency registry — to inject JavaScript into Vietnamese streaming sites, demonstrating how supply chain compromise can weaponize developer ecosystems against end users. The injected scripts exploited unpatched WebKit vulnerabilities on iOS devices, enabling theft of cryptocurrency wallet seed phrases, which permanently compromises a victim's funds with no recovery path. This campaign highlights the dual risk of unvetted open-source dependencies and delayed mobile OS patching, where either failure alone creates an exploitable gap. The combination of supply chain infiltration and client-side exploitation underscores that defending users requires both securing the software pipeline and maintaining up-to-date device firmware.",[165,166,167,168,169,170,171,172,173,174,175],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-218 (SSDF): Supply Chain Security Practice PW.4","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST CSF ID.SC-3: Suppliers and third-party partners are identified and assessed","NIST SP 800-40 Rev. 4: Patch Management Guidance","OWASP A06:2021 – Vulnerable and Outdated Components","OWASP A08:2021 – Software and Data Integrity Failures","ISO\u002FIEC 27001:2022 Annex A 8.30: Outsourced Development","GDPR Article 32: Security of Processing (where EU user data is involved)",{}]