Skip to content
Threat Feed

Vendor

Intercom

2 briefs RSS
critical threat

Compromised intercom-php Package on GitHub

A malicious commit tagged as version 5.0.2 was pushed to the intercom/intercom-php repository on GitHub, containing a Composer plugin that downloaded the Bun JavaScript runtime and executed an obfuscated credential-harvesting payload, targeting cloud provider credentials, environment variables, SSH keys, and CI/CD secrets.

intercom-php Mini Shai-Hulud supply-chain credential-theft github
2r 1t
critical advisory

Compromised intercom-client npm Package Exfiltrates Credentials

A compromised version (7.0.4) of the intercom-client npm package was published using a compromised developer account, containing obfuscated JavaScript that executed during installation to harvest and exfiltrate credentials from the environment, as part of the 'Mini Shai-Hulud' supply chain campaign.

intercom-client +5 supply-chain credential-theft npm
2r 2t