Do Son Socket exposes a clever cross-ecosystem supply chain attack targeting PHP packages by hiding a malicious JS postinstall backdoor inside package.json.
Postinstall Script
A malicious unscoped "tanstack" npm package used live-debugged postinstall scripts to steal .env secrets via Svix webhooks. Check your dependencies now.
Datadog exposed MUT-4831, a cluster that deployed Vidar Infostealer via 17 malicious npm packages. The malware uses postinstall scripts to download and execute the payload, stealing credentials and crypto wallets.