North Korean Chollima Group Abuses Packagist Package to Infect PHP Developers

Security researchers discovered obfuscated JavaScript hidden inside a Packagist development version of the legitimate Laravel package roberts/leads. The malicious code was appended to tailwind.js in the dev branch, drewroberts/feature/test-case.

It was exposed as an installable dev version on Packagist. Socket’s AI scanner flagged the version after detecting runtime reconstruction of Node.js internals and immediate execution of a decoded staging payload instead of normal Tailwind configuration logic.

At first glance, the file looked like a normal Tailwind configuration:

module.exports = {
purge: [],
theme: { extend: {} },
variants: {},
plugins: [],
};

But far to the right, after a large whitespace gap, the file continued with obfuscated JavaScript unrelated to Tailwind.

The appended code reconstructs global variables and Node.js internals at runtime, then retrieves encrypted payload material from blockchain and public RPC services, decrypts it using hardcoded XOR keys, and executes it with eval().

The loader can also spawn a detached hidden Node.js child process to run a second-stage payload.

Deobfuscation shows the loader uses a blockchain dead-drop design. It first queries TRON account transactions to find a pointer.

If that fails, it falls back to Aptos transaction data. It then requests the input data for a BNB Smart Chain transaction to obtain the encrypted content.

The loader decrypts that content, executes the first-stage payload in-process, and may launch a hidden node process with the second-stage payload.

This approach lets the attacker change payloads without modifying the package source, and it hides the network path by using public blockchain infrastructure rather than a traditional command-and-control domain.

Indicators and infrastructure match prior campaigns linked to North Korean APT activity, often tracked as Famous Chollima or related groups.

These groups have previously used fake-company and fake-interview lures to trick developers into running poisoned code.

In earlier incidents, similar blockchain-based loaders delivered DPRK-linked malware families, including DEV#POPPER RAT, OmniStealer, and BeaverTail.

The same wallet addresses, Aptos identifiers, and XOR patterns have appeared across public reports.

According to Socket research, the Socket AI Scanner reported the malicious Packagist version to Packagist’s security team, which quickly reviewed and removed the dev version.

The project maintainer was notified on GitHub and by email. The affected GitHub branch and tailwind.js file were also flagged to GitHub Security for investigation.

Researchers preserved branch and commit evidence and shared hashes and IOCs for detection.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.