Skip to content
Threat Feed

Product

Intercom-Php

1 brief RSS
critical threat

Compromised intercom-php Package on GitHub

A malicious commit tagged as version 5.0.2 was pushed to the intercom/intercom-php repository on GitHub, containing a Composer plugin that downloaded the Bun JavaScript runtime and executed an obfuscated credential-harvesting payload, targeting cloud provider credentials, environment variables, SSH keys, and CI/CD secrets.

intercom-php Mini Shai-Hulud supply-chain credential-theft github
2r 1t