# Packagist cross-ecosystem postinstall attack - 8 Composer packages drop Linux `gvfsd-network` binary

> Socket disclosed on 2026-05-23 a coordinated campaign that planted a malicious `postinstall` hook in the `package.json` (NOT `composer.json`) of eight Packagist Composer packages - including `devdojo/wave`, `devdojo/genesis`, and `katanaui/katana`. The hook curls a Linux binary `gvfsd-network` from `github.com/parikhpreyash4/systemd-network-helper-aa5c751f`, writes it to `/tmp/.sshd`, and runs it backgrounded. Socket flagged the same payload in 700+ public GitHub repos.

- Published: 2026-05-22
- Last updated: 2026-05-26
- Severity: high
- Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- Ecosystems: Packagist
- Scope: 8 packages, 0 compromised versions
- Tags: ci-cd-compromise, maintainer-takeover, obfuscation, cdn-supply-chain
- Detected by: Socket
- Incident ID: packagist-2026-05-22-cross-ecosystem-postinstall-binary

## Affected packages (8)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [baskarcm/tzi-chat-ui](https://dependencywatch.io/package/packagist/baskarcm/tzi-chat-ui) | Packagist |  |
| [crosiersource/crosierlib-base](https://dependencywatch.io/package/packagist/crosiersource/crosierlib-base) | Packagist |  |
| [devdojo/genesis](https://dependencywatch.io/package/packagist/devdojo/genesis) | Packagist |  |
| [devdojo/wave](https://dependencywatch.io/package/packagist/devdojo/wave) | Packagist |  |
| [elitedevsquad/sidecar-laravel](https://dependencywatch.io/package/packagist/elitedevsquad/sidecar-laravel) | Packagist |  |
| [katanaui/katana](https://dependencywatch.io/package/packagist/katanaui/katana) | Packagist |  |
| [moritz-sauer-13/silverstripe-cms-theme](https://dependencywatch.io/package/packagist/moritz-sauer-13/silverstripe-cms-theme) | Packagist |  |
| [r2luna/brain](https://dependencywatch.io/package/packagist/r2luna/brain) | Packagist |  |

## What happened

On **2026-05-22** Socket's scanners flagged a coordinated supply-chain campaign that planted an identical malicious `postinstall` hook in the `package.json` of eight Packagist Composer packages. The payload was disclosed publicly on 2026-05-23 and amplified by The Hacker News, GuardianMSSP and several syndicated outlets the same day. The standout characteristic is **cross-ecosystem placement**: every affected package is a Composer/PHP project, but the malicious code lives in `package.json` rather than `composer.json`. PHP security teams and Composer-aware scanners do not typically inspect npm lifecycle scripts bundled inside a PHP repo, so the attack rides through unmodified.

The `postinstall` hook runs a single shell pipeline: it `curl -k`'s the binary `gvfsd-network` from `github.com/parikhpreyash4/systemd-network-helper-aa5c751f` (a GitHub Releases URL), writes it to `/tmp/.sshd`, `chmod`s it executable, and starts it backgrounded. The use of `-k` disables TLS certificate verification; stderr is suppressed and execution is detached so a failed download never breaks the install. The binary name `gvfsd-network` masquerades as the GNOME Virtual File System network daemon to blend into a normal Linux process list.

The **eight confirmed affected Composer packages**, all with malicious commits on dev-branch refs (not on tagged releases), are:

- `devdojo/wave` (dev-main) - Laravel SaaS starter, ~1K installs
- `devdojo/genesis` (dev-main) - devdojo project
- `katanaui/katana` (dev-main) - Tony Lea / devdojo UI kit
- `crosiersource/crosierlib-base` (dev-master) - Crosier base library
- `moritz-sauer-13/silverstripe-cms-theme` (dev-master) - SilverStripe CMS theme
- `elitedevsquad/sidecar-laravel` (3.x-dev) - Sidecar Laravel integration
- `r2luna/brain` (dev-main)
- `baskarcm/tzi-chat-ui` (dev-main)

Three of the eight (`devdojo/wave`, `devdojo/genesis`, `katanaui/katana`) share the maintainer email `tony.woop@devdojo.com`, strongly suggesting at least one compromised GitHub account is the common pivot. The other five span unrelated organisations - Socket's working hypothesis is that several maintainer accounts were independently breached by the same operator, plausibly via credential reuse or infostealer harvests.

- A GitHub code search for `parikhpreyash4` returned hundreds of public hits within roughly 17 hours of detection, and Socket extended its scan to **700+ public GitHub repositories** carrying the same `postinstall`-into-`/tmp/.sshd` fingerprint - including many Node.js projects unrelated to the eight Packagist packages. The Packagist 8 are the *confirmed* registry-published surface; the GitHub 700+ are public repos that any clone-then-install workflow would also hit.
- Packagist removed the malicious commits and the affected branches have since been cleaned up; the maintainer-side incident response is ongoing as of disclosure.
- The malicious code was never present on tagged releases of any of the 8 packages - anyone pinned to a tagged version (`^1.0`, `~2.5`, etc.) was not exposed. Exposure was limited to consumers resolving the affected dev-branch refs.
- Attribution is open: the `parikhpreyash4` GitHub account is single-use throwaway infrastructure and the payload is a generic ELF dropper rather than the Mini Shai-Hulud / TeamPCP credential stealer pattern seen elsewhere this week. No vendor has tied this to a named actor as of disclosure.

Mechanically, this is the **cross-ecosystem hook** attack class. Adopt npm-aware scanning on PHP repos that ship JS build tooling, pin away from `dev-*` Composer constraints for third-party packages, and treat package-level postinstall hooks as a high-risk supply-chain surface regardless of the host language.

## Impact

- Remote code execution on any Linux host (developer or CI runner) that runs `npm install` / `yarn install` against an affected package - the hook fires from `package.json`, not `composer.json`, so Composer-only scanners miss it entirely
- Cross-ecosystem evasion: PHP / Composer security tooling does not look at `package.json` lifecycle hooks; npm tooling does not scan PHP repos
- Persistent Linux backdoor dropped at `/tmp/.sshd` (named `gvfsd-network` to masquerade as a GNOME GVfs daemon)
- `curl -k` disables TLS verification, hiding the download from cert-pinning egress controls; stderr is suppressed and the binary backgrounded to avoid breaking the install
- Same payload found in 700+ public GitHub repos, including many Node.js projects - exposure extends far beyond the 8 confirmed Packagist names
- The malicious commits landed on dev-branch refs (`dev-main`, `dev-master`, `3.x-dev`) - anyone resolving `dev-*` Composer constraints pulled the payload

## What to do

1. Audit `composer.lock` / `composer.json` for any of these 8 vendor names: `devdojo/wave`, `devdojo/genesis`, `katanaui/katana`, `crosiersource/crosierlib-base`, `moritz-sauer-13/silverstripe-cms-theme`, `elitedevsquad/sidecar-laravel`, `r2luna/brain`, `baskarcm/tzi-chat-ui`
2. On any host or CI runner that ran `npm install` (transitively or directly) against an affected package since 2026-05-22: assume Linux compromise. Look for `/tmp/.sshd`, recently-started background processes named `gvfsd-network`, and outbound connections initiated from `/tmp/.sshd`
3. Block egress to `github.com/parikhpreyash4/*` release URLs from CI/CD and production network paths until GitHub takes the account down
4. Grep your dependency trees and CI workspaces for the literal install command `curl -k` piping to `/tmp/.sshd` - Socket reports the same fingerprint in 700+ public GitHub repos beyond the confirmed Packagist names
5. Pin Composer dev-branch dependencies to known-clean commit SHAs predating 2026-05-22, or move off dev-branch constraints altogether - branch refs are mutable and re-resolve on every `composer update`
6. If you ship JavaScript build tooling alongside PHP, run npm-aware scanners on the same repo - Composer-only tooling will not catch hooks planted in `package.json`

## References

- [Malicious postinstall hook found across 700+ GitHub repos](https://socket.dev/blog/malicious-postinstall-hook-found-across-700-github-repos) - Socket
- [Packagist supply chain attack infects 8 packages using GitHub-hosted Linux malware](https://thehackernews.com/2026/05/packagist-supply-chain-attack-infects-8.html) - The Hacker News
- [Packagist: devdojo/wave](https://packagist.org/packages/devdojo/wave) - Packagist
- [Packagist: katanaui/katana](https://packagist.org/packages/katanaui/katana) - Packagist

---

Canonical page: https://dependencywatch.io/incident/packagist-2026-05-22-cross-ecosystem-postinstall-binary
Markdown version: https://dependencywatch.io/incident/packagist-2026-05-22-cross-ecosystem-postinstall-binary.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).