The threat involves a supply chain attack targeting the PHP ecosystem via a malicious artifact of the intercom/intercom-php package version 5.0.2 on Packagist. The compromised package exploits Composer plugin execution to download and run the Bun runtime, which executes an obfuscated credential-stealing payload during installation. This payload harvests a wide range of sensitive credentials from developer and CI/CD environments, encrypts the stolen data using AES-256-GCM, and exfiltrates it to attacker infrastructure. Additionally, the payload contains logic to propagate the attack by modifying GitHub repositories and npm packages using the stolen credentials. This attack represents an expansion of the Mini Shai-Hulud supply chain attack previously seen in the npm ecosystem. The compromised package was installed approximately 12,700 times daily before its removal.

The impact includes theft of highly sensitive credentials such as GitHub tokens, cloud provider credentials, SSH keys, Kubernetes tokens, and HashiCorp Vault secrets from developer machines and CI/CD environments. This can lead to unauthorized access to source code repositories, cloud infrastructure, and other critical systems. The attacker can also propagate the attack by modifying repositories and npm packages using stolen credentials, potentially expanding the compromise. The widespread installation rate suggests a significant exposure before the package was removed.

No official patch or remediation guidance is provided in the available data. Since this is a supply chain compromise involving a malicious package version, the primary mitigation is to remove the compromised intercom/intercom-php package version 5.0.2 from affected environments and replace it with a verified clean version. Developers and organizations should audit their environments for signs of credential theft and unauthorized repository or package modifications. Monitoring for use of stolen credentials and rotating all potentially exposed secrets is recommended. Patch status is not yet confirmed — check the vendor advisory or Packagist announcements for current remediation guidance.