# 6 malicious Packagist OphimCMS themes ship trojanised jQuery and FUNNULL redirects

> Six Composer packages from the `ophimcms` organisation posed as OphimCMS themes containing trojanised jQuery. The payload exfiltrates URLs, injects ads, and redirects mobile traffic via OFAC-sanctioned FUNNULL infrastructure. Combined ~2,750 installs.

- Published: 2026-03-12
- Severity: medium
- Kind: Malicious package - A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.
- Ecosystems: Packagist
- Scope: 6 packages, 6 compromised versions
- Tags: cdn-supply-chain, obfuscation, dormant-domain
- Detected by: Socket
- Incident ID: packagist-2026-03-12-ophimcms-themes

## Affected packages (6)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [ophimcms/theme-dy](https://dependencywatch.io/package/packagist/ophimcms/theme-dy) | Packagist | 1.0.0 |
| [ophimcms/theme-legend](https://dependencywatch.io/package/packagist/ophimcms/theme-legend) | Packagist | 1.0.0 |
| [ophimcms/theme-motchill](https://dependencywatch.io/package/packagist/ophimcms/theme-motchill) | Packagist | 1.0.0 |
| [ophimcms/theme-mtyy](https://dependencywatch.io/package/packagist/ophimcms/theme-mtyy) | Packagist | 1.0.0 |
| [ophimcms/theme-pcc](https://dependencywatch.io/package/packagist/ophimcms/theme-pcc) | Packagist | 1.2.2 |
| [ophimcms/theme-rrdyw](https://dependencywatch.io/package/packagist/ophimcms/theme-rrdyw) | Packagist | 1.0.0 |

## What happened

Six Composer packages published under the `ophimcms` Packagist organisation impersonated themes for OphimCMS, a Vietnamese-language movie-streaming CMS. Each shipped a trojanised copy of jQuery whose extra code phones home with the visiting URL, injects ad markup, and conditionally redirects mobile browsers to gambling and adult sites.

The combined install count across the six packages was roughly `2,750`, modest in absolute terms but high-impact because every install translates into a live theme on a public web property. Affected packages include `ophimcms/theme-dy`, `ophimcms/theme-mtyy`, `ophimcms/theme-rrdyw`, `ophimcms/theme-pcc`, `ophimcms/theme-motchill`, and `ophimcms/theme-legend`.

Redirect and telemetry traffic terminates at infrastructure operated by **FUNNULL**, a CDN provider sanctioned by the U.S. Treasury OFAC in 2025 for facilitating pig-butchering scam infrastructure. The hardcoded callouts include:

- `union.macoms.la` - URL telemetry collector
- `userstat.net` - secondary beacon
- `cre-ads.com` - ad / redirect orchestrator

The trojanised jQuery files are byte-identical to legitimate jQuery for most of their length, so naive diff-based reviews against a stock vendor copy miss the appended payload. Socket flagged the org publicly on `2026-03-12`.

## Impact

- Visitors to sites using these themes get redirected to gambling / adult content
- URL telemetry exfiltrated to attacker domains
- Uses OFAC-sanctioned FUNNULL hosting infrastructure

## What to do

1. Remove all `ophimcms/theme-*` packages from Composer projects
2. Block listed FUNNULL domains at the perimeter (`union.macoms.la`, `userstat.net`, `cre-ads.com`)

## References

- [6 Malicious Packagist Themes Ship Trojanized jQuery](https://socket.dev/blog/6-malicious-packagist-themes-ship-trojanized-jquery) - Socket
- [Treasury Sanctions FUNNULL Technology and Administrator](https://home.treasury.gov/news/press-releases/sb0149) - U.S. Treasury
- [Packagist: ophimcms organisation](https://packagist.org/packages/ophimcms/) - Packagist

---

Canonical page: https://dependencywatch.io/incident/packagist-2026-03-12-ophimcms-themes
Markdown version: https://dependencywatch.io/incident/packagist-2026-03-12-ophimcms-themes.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).