Hackers Hide Linux Malware in SSH-Like Package Filename

Hackers have been observed disguising a malicious Linux payload under an SSH-like filename during software installation, as part of a coordinated supply chain attack targeting developer ecosystems.

The attack hinges on a hidden post-install script embedded inside package.json, rather than the expected composer.json used in PHP environments.

This subtle placement allows the malicious code to evade detection during routine dependency reviews focused only on Composer metadata.

When triggered, the script executes a command that:

• Downloads a binary from a GitHub Releases URL controlled by the attacker.
• Saves it to /tmp/.sshd, mimicking a legitimate SSH file.
• Marks it as executable.
• Runs it in the background while suppressing errors.

The use of /tmp/.sshd is particularly deceptive, as it blends in with typical system process names, reducing suspicion during incident response.

Socket identified eight compromised Packagist packages tied to development branches such as dev-main and dev-master. These include widely used projects like devdojo/wave and devdojo/genesis, both Laravel starter kits with thousands of installations.

Security researchers at Socket uncovered the campaign affecting multiple Packagist packages, where compromised upstream repositories were modified to execute malicious code during installation silently.

The malicious payload was consistent across all affected packages, indicating a coordinated campaign rather than isolated incidents. Notably, the attack primarily impacts projects that combine PHP backends with JavaScript tooling, where npm install triggers lifecycle scripts.

A broader GitHub search linked the campaign to an attacker-controlled account, revealing hundreds of repositories containing similar payload references. While not all instances are confirmed compromises, the scale suggests widespread reuse of the same infrastructure.

Hackers Hide Linux Malware in SSH

Investigations show that attackers directly modified upstream GitHub repositories by inserting malicious commits. Since Packagist automatically tracks these repositories, the infected code was propagated into package distributions without requiring a breach of Packagist itself.

A GitHub code search for the attacker-controlled account parikhpreyash4 returned hundreds of public code results approximately 17 hours after the first detection, including many Node.js repositories.

This technique highlights a critical weakness in branch-tracking versions. Unlike fixed releases, versions such as dev-main dynamically reflect the latest repository state, meaning malicious changes can be introduced and later removed without leaving obvious traces in version labels.

Beyond package installation, the same payload was also discovered in GitHub Actions workflows. Infected repositories included malicious steps disguised as routine tasks like “Dependency Cache Sync,” ensuring execution during automated build and deployment processes.

This dual execution strategy via postinstall scripts and CI/CD workflows demonstrates the attacker’s intent to maximize reach across both developer machines and production pipelines.

The campaign enables remote code execution during package installation. Key risk factors include:

• Disabled TLS verification (curl -k), allowing insecure downloads.
• Execution of unauthenticated binaries without integrity checks.
• Background execution and error suppression to evade detection.

Although the second-stage payload is no longer accessible, the initial downloader behavior alone is sufficient to classify the packages as malicious.

Starter kits present the highest risk because they place the malicious package.json at the project root, ensuring the script executes immediately during setup. In contrast, library dependencies installed under vendor/ are less likely to trigger such scripts unless explicitly invoked.

Mitigations

Organizations should take the following steps:

• Audit both composer.json and package.json files in dependencies.
• Avoid relying on branch-tracking versions for production use.
• Monitor install-time scripts and block unexpected network calls.
• Use software composition analysis (SCA) tools to detect suspicious behaviors.
• Review CI/CD workflows for unauthorized commands or external downloads.

Socket reported the affected packages to Packagist, which removed them. However, due to the nature of branch-tracking versions, compromised packages may reappear if upstream repositories remain unpatched.

This campaign underscores the growing complexity of software supply chain attacks, especially in hybrid ecosystems where multiple package managers coexist.

Developers and security teams must expand their visibility beyond a single dependency layer to effectively detect and prevent such threats.

Indicators of Compromise

GitHub account:

• parikhpreyash4

GitHub repository:

• parikhpreyash4/systemd-network-helper-aa5c751f

Payload URL:

• https://github.com/parikhpreyash4/systemd-network-helper-aa5c751f/releases/latest/download/gvfsd-network

Payload File Path:

• /tmp/.sshd
• Suspicious command fragments:
  • curl -skL
  • chmod +x /tmp/.sshd
  • /tmp/.sshd &

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.