[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqaJGrbkWqQFSZyvUf_m7okKAo1JFCEru-6W2N9LsiXI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":57},"76367baa-6235-4fb9-95fc-cc65c1a8ce49","malicious-packagist-packages-exploit-unpatched-ios-webkit-to-steal-crypto-seeds","30f4a021-57c9-4c4c-ac6e-3976d955f277","Malicious Packagist Packages Exploit Unpatched iOS WebKit to Steal Crypto Seeds","Attackers published 13 malicious Composer packages on Packagist — a trusted PHP dependency registry — to inject JavaScript into Vietnamese streaming sites, demonstrating how supply chain compromise can weaponize developer ecosystems against end users. The injected scripts exploited unpatched WebKit vulnerabilities on iOS devices, enabling theft of cryptocurrency wallet seed phrases, which permanently compromises a victim's funds with no recovery path. This campaign highlights the dual risk of unvetted open-source dependencies and delayed mobile OS patching, where either failure alone creates an exploitable gap. The combination of supply chain infiltration and client-side exploitation underscores that defending users requires both securing the software pipeline and maintaining up-to-date device firmware.","**Immediate actions:**\n- Audit all Composer\u002FPackagist dependencies in your projects using tools like `composer audit` or Sonatype Nexus to identify and remove the 13 known malicious packages.\n- Apply the latest iOS and WebKit security updates immediately across all managed and BYOD devices to close the exploited vulnerabilities.\n- Implement Subresource Integrity (SRI) hashes on all third-party JavaScript inclusions to detect unauthorized script injection.\n\n**Long-term improvements:**\n- Establish a formal Software Composition Analysis (SCA) process that automatically scans all open-source dependencies before merging into production pipelines.\n- Enforce a Mobile Device Management (MDM) policy that mandates minimum OS patch levels and blocks non-compliant devices from accessing corporate or sensitive resources.\n- Maintain a vetted, internal package mirror or allowlist of approved Packagist packages to prevent developers from pulling unreviewed dependencies.\n\n**Detection measures:**\n- Deploy Content Security Policy (CSP) headers on all web properties to detect and block unauthorized JavaScript execution from unexpected sources.\n- Monitor dependency manifests (`composer.lock`) for unexpected changes or newly added packages as part of your CI\u002FCD pipeline security checks.\n- Enable mobile threat detection tooling to alert on spyware behaviors such as unauthorized access to clipboard or wallet application data on iOS devices.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-218 (SSDF): Supply Chain Security Practice PW.4","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST CSF ID.SC-3: Suppliers and third-party partners are identified and assessed","NIST SP 800-40 Rev. 4: Patch Management Guidance","OWASP A06:2021 – Vulnerable and Outdated Components","OWASP A08:2021 – Software and Data Integrity Failures","ISO\u002FIEC 27001:2022 Annex A 8.30: Outsourced Development","GDPR Article 32: Security of Processing (where EU user data is involved)",{},"published","2026-09-01T16:21:17.459135+00:00","2026-09-01T16:21:17.14+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002F13-malicious-packagist-packages-target.html","13-malicious-packagist-packages-target-unpatched-iphones-to-steal-crypto-wallet--2e1433","13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[51],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"b16a8f47-c551-49b4-86b2-74931af4abf4","2026-09-02","morning","ThreatNoir Morning Brief — September 2","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-02\u002Fthreatnoir-morning-brief-2026-09-02.mp3",[58,61,65],{"slug":35,"name":59,"problem":60},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":62,"name":63,"problem":64},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":66,"name":67,"problem":68},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]