A malicious commit was pushed to the intercom/intercom-php GitHub repository on April 30, 2026, tagged as version 5.0.2. This compromised version contained a Composer plugin that downloaded and executed a credential-harvesting payload targeting cloud credentials, environment variables, SSH keys, and CI/CD secrets. The malicious tag was live for less than two hours before being reverted. Versions 5.0.1 and earlier are unaffected. Users who installed version 5.0.2 during the affected window should consider credentials compromised and rotate them.