Chollima Hackers Target PHP Developers via Compromised Packagist Package

Key Takeaways

• North Korean threat actor Famous Chollima is executing a sophisticated supply chain attack targeting PHP developers.
• The attackers embedded malicious JavaScript within a legitimate PHP package, roberts/leads, distributed via Packagist.
• The malware, disguised as a Tailwind CSS configuration file, utilizes public blockchain services (TRON, Aptos, BNB Smart Chain) as a covert command-and-control mechanism.
• This highly targeted campaign aims to compromise individual developers, exfiltrating sensitive data like cloud credentials and SSH keys.
• The compromised package version has been reported and removed from Packagist.

North Korean APT Famous Chollima Infiltrates PHP Ecosystem via Packagist Supply Chain Attack

The notorious North Korean state-sponsored hacking group, Famous Chollima, has launched a cunning supply chain attack by injecting malware into a legitimate PHP package available on Packagist, PHP’s primary package repository. This campaign specifically targets software developers, leveraging a seemingly innocuous configuration file to deliver a dangerous payload, as detailed in a recent security report.

This method of attack is particularly insidious because it seamlessly integrates into standard development workflows, making early detection extremely difficult. Famous Chollima, known for its history of targeting developers, has previously gained notoriety for tactics ranging from infiltrating companies as fake employees to more recently, luring engineers into executing malicious code through deceptive job offers and development tasks.

Malicious Code Hidden in Plain Sight

Security researchers at Socket.dev uncovered malicious JavaScript concealed within a file named tailwind.js. This file was bundled with the development version dev-drewroberts/feature/test-case of the PHP package roberts/leads on Packagist. The fact that the package belongs to a legitimate maintainer, Drew Roberts, suggests a compromise at the branch level or a poisoned workflow injection, rather than the creation of an entirely fabricated package.

The malware itself was cleverly hidden within what appeared to be a standard Tailwind CSS configuration file. The harmful code was positioned far to the right of the screen, obscured by a large block of blank space, designed to evade casual code reviews. Upon execution, this obfuscated code transforms into a fully functional JavaScript malware loader operating within a Node.js environment.

The attackers specifically targeted a development branch, which requires explicit installation commands. This detail indicates that the campaign is likely designed for highly targeted attacks, where victims would be instructed to run a very specific command—a scenario that could easily occur during a fake job interview or a simulated developer onboarding process. Famous Chollima appears to have engineered this operation for precision targeting of individual developers rather than a widespread, easily detectable infection.

Advanced C2 via Blockchain Services

The malicious loader within tailwind.js employs an unconventional command-and-control (C2) mechanism. Instead of connecting to traditional suspicious servers, it communicates with public blockchain services, including TRON, Aptos, and BNB Smart Chain. The encrypted payload data is retrieved from within blockchain transaction records, a “dead-drop” method that bypasses conventional security tools designed to block typical C2 domains, making detection significantly more challenging.

The loader uses hardcoded XOR keys to decrypt the retrieved material, which is then executed directly within Node.js using eval(). It can also discreetly launch a second, hidden process in the background using child_process.spawn() with the windowsHide flag set to true, ensuring stealth on Windows systems. A campaign marker, global['!']='9-0264-2', embedded in the code, has been linked to previous Famous Chollima operations, tying this attack to known malware families such as DEV#POPPER RAT, OmniStealer, and BeaverTail payloads.

Exfiltration Scope and Developer Risk

While the local loader doesn’t directly exfiltrate files, the remote payload it fetches grants extensive access to the victim’s machine. Once active within Node.js, the malware can read environment variables containing cloud credentials and CI secrets, access local files like .env files and SSH keys, steal stored tokens, and initiate additional processes. The true destructive potential resides in the payload retrieved from the blockchain, not in the initial visible code.

What You Should Do

• Exercise Extreme Caution: Treat any unfamiliar build instructions received during job interviews or remote tasks as potential code execution events.
• Manual Code Review: Before running any unknown PHP or JavaScript project, meticulously inspect files such as tailwind.js, webpack.mix.js, vite.config.*, postcss.config.*, and .github/workflows for suspicious or obfuscated code.
• Monitor Network Traffic: Security teams should monitor for Node.js processes attempting to connect to blockchain or RPC services, especially during build pipelines.
• Limit Credential Exposure: Organizations should avoid exposing long-lived cloud credentials to development branch builds. Implement least privilege principles for all build environments.
• Pin Stable Versions: Package consumers should always pin stable, known-good versions of dependencies and avoid using development branches unless absolutely necessary.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.