#packagist — Public Fediverse posts

«Fix typo»: как в PHP закоммитили бэкдор и почему composer install — это акт доверия

Каждый composer install — это акт доверия: вы запускаете на CI и в проде код, который собрал и опубликовал кто‑то другой, а проверяете обычно лишь хеш в composer.lock. Но хеш отвечает на вопрос «тот же ли это байт, что вчера», а не «кто и из чего его собрал». Реальные инциденты показывают цену этого доверия: в 2021-м в исходники PHP закоммитили бэкдор от имени Расмуса Лердорфа; в xz вредонос жил в release‑архиве, которого не было в git; у популярного GitHub Action переписали теги и слили секреты из тысяч пайплайнов. Между кодом на ревью и артефактом в вашем vendor/ — длинная цепочка, и атаковать можно любое звено. В статье сначала разбор: как устроены эти атаки и почему GPG, хеши и composer audit закрывают цепочку лишь частично. Затем ответ индустрии — Sigstore: подпись без управления ключами. И главное — практика на PHP: подписываем релиз в GitHub Actions без единого секрета, проверяем эталонным gh, из CLI и прямо из кода с типизированным SLSA‑провенансом, мониторим журнал Rekor. С рабочим кодом и честной моделью угроз: что подпись ловит, а что нет. Разобрать цепочку поставок ПО

https://habr.com/ru/articles/1048056/

#supply_chain_security #Sigstore #Rekor #Fulcio #SLSA #Composer #Packagist #аттестация_артефактов #github_actions #php

«Fix typo»: как в PHP закоммитили бэкдор и почему composer install — это акт доверия

Каждый composer install — это акт доверия: вы запускаете на CI и в проде код, который собрал и опубликовал кто‑то другой, а проверяете обычно лишь хеш в composer.lock. Но хеш отвечает на вопрос «тот же ли это байт, что вчера», а не «кто и из чего его собрал». Реальные инциденты показывают цену этого доверия: в 2021-м в исходники PHP закоммитили бэкдор от имени Расмуса Лердорфа; в xz вредонос жил в release‑архиве, которого не было в git; у популярного GitHub Action переписали теги и слили секреты из тысяч пайплайнов. Между кодом на ревью и артефактом в вашем vendor/ — длинная цепочка, и атаковать можно любое звено. В статье сначала разбор: как устроены эти атаки и почему GPG, хеши и composer audit закрывают цепочку лишь частично. Затем ответ индустрии — Sigstore: подпись без управления ключами. И главное — практика на PHP: подписываем релиз в GitHub Actions без единого секрета, проверяем эталонным gh, из CLI и прямо из кода с типизированным SLSA‑провенансом, мониторим журнал Rekor. С рабочим кодом и честной моделью угроз: что подпись ловит, а что нет. Разобрать цепочку поставок ПО

https://habr.com/ru/articles/1048056/

#supply_chain_security #Sigstore #Rekor #Fulcio #SLSA #Composer #Packagist #аттестация_артефактов #github_actions #php

«Fix typo»: как в PHP закоммитили бэкдор и почему composer install — это акт доверия

Каждый composer install — это акт доверия: вы запускаете на CI и в проде код, который собрал и опубликовал кто‑то другой, а проверяете обычно лишь хеш в composer.lock. Но хеш отвечает на вопрос «тот же ли это байт, что вчера», а не «кто и из чего его собрал». Реальные инциденты показывают цену этого доверия: в 2021-м в исходники PHP закоммитили бэкдор от имени Расмуса Лердорфа; в xz вредонос жил в release‑архиве, которого не было в git; у популярного GitHub Action переписали теги и слили секреты из тысяч пайплайнов. Между кодом на ревью и артефактом в вашем vendor/ — длинная цепочка, и атаковать можно любое звено. В статье сначала разбор: как устроены эти атаки и почему GPG, хеши и composer audit закрывают цепочку лишь частично. Затем ответ индустрии — Sigstore: подпись без управления ключами. И главное — практика на PHP: подписываем релиз в GitHub Actions без единого секрета, проверяем эталонным gh, из CLI и прямо из кода с типизированным SLSA‑провенансом, мониторим журнал Rekor. С рабочим кодом и честной моделью угроз: что подпись ловит, а что нет. Разобрать цепочку поставок ПО

https://habr.com/ru/articles/1048056/

#supply_chain_security #Sigstore #Rekor #Fulcio #SLSA #Composer #Packagist #аттестация_артефактов #github_actions #php

Takeaways from @naderman’s #PHPverse talk.

#PHP #Packagist

Takeaways from @naderman’s #PHPverse talk.

#PHP #Packagist

Who pays for #Packagist?

#PHP #PHPverse

Who pays for #Packagist?

#PHP #PHPverse

The infrastructure behind #Packagist

#PHP #PHPverse

The infrastructure behind #Packagist

#PHP #PHPverse

#Packagist The Road Ahead: Build provenance and verification

#PHP #PHPVerse

#Packagist The Road Ahead: Build provenance and verification

#PHP #PHPVerse

Minimum release age (cooldown) is coming to #Packagist!

#PHP #PHPverse

Minimum release age (cooldown) is coming to #Packagist!

#PHP #PHPverse

RE: https://mastodon.social/@seldaek/116651920344034250

I am very excited about this update!

The #PHP ecosystem cannot thank @seldaek, @naderman, and everyone at #Packagist and everybody contributing to #Composer enough for the amazing work they are doing.

RE: https://mastodon.social/@seldaek/116651920344034250

I am very excited about this update!

The #PHP ecosystem cannot thank @seldaek, @naderman, and everyone at #Packagist and everybody contributing to #Composer enough for the amazing work they are doing.

🔗 An Update on Composer & Packagist Supply Chain Security
https://blog.packagist.com/an-update-on-composer-packagist-supply-chain-security/
#php #security #composer #packagist #supplychain

🔗 An Update on Composer & Packagist Supply Chain Security
https://blog.packagist.com/an-update-on-composer-packagist-supply-chain-security/
#php #security #composer #packagist #supplychain

📰 Packagist Supply Chain Attack Uses Clever Evasion to Infect PHP Projects with Linux Malware

🚨 PHP supply chain attack hits Packagist! 8+ packages compromised to drop Linux malware. Attackers hid malicious code in `package.json` to evade PHP security scanners. #SupplyChainAttack #PHP #Packagist #CyberSecurity

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/coordinated-packagist-attack-infects-php-projects-with-linux-malware/?utm_source=mastodon&utm_…

📰 Packagist Supply Chain Attack Uses Clever Evasion to Infect PHP Projects with Linux Malware

🚨 PHP supply chain attack hits Packagist! 8+ packages compromised to drop Linux malware. Attackers hid malicious code in `package.json` to evade PHP security scanners. #SupplyChainAttack #PHP #Packagist #CyberSecurity

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/coordinated-packagist-attack-infects-php-projects-with-linux-malware/?utm_source=mastodon&utm_…

GitHub-Hosted Malware Targets PHP Packages in Coordinated Supply Chain Attack

Malicious code was injected into eight PHP packages on Packagist, triggering a Linux binary download from GitHub Releases via JavaScript lifecycle hooks in package.json postinstall scripts. The attack was swiftly contained, with the malicious versions removed from Packagist.

https://osintsights.com/github-hosted-malware-targets-php-packages-in-coordinated-supply-chain-attack?utm_source=mastodon&utm_medium=social

#SupplyChainAttack #Github #Php #Packagist #Javascript

🚨 A compromise affecting the community-maintained Laravel Lang project introduced remote code execution backdoors across multiple packages, including:

- Laravel-Lang/lang
- Laravel-Lang/http-statuses
- Laravel-Lang/actions
- Laravel-Lang/attributes

All tags were rewritten pointing to malicious commits

https://www.aikido.dev/blog/supply-chain-attack-targets-laravel-lang-packages-with-credential-stealer

https://github.com/Laravel-Lang/lang/issues/8295

https://github.com/Laravel-Lang/common/issues/257

https://www.stepsecurity.io/blog/laravel-lang-supply-chain-attack

https://socket.dev/blog/laravel-lang-compromise

#PHP #Laravel #SupplyChainAttack #RemoteCodeExecution #RCE #Packagist

🚨 A compromise affecting the community-maintained Laravel Lang project introduced remote code execution backdoors across multiple packages, including:

- Laravel-Lang/lang
- Laravel-Lang/http-statuses
- Laravel-Lang/actions
- Laravel-Lang/attributes

All tags were rewritten pointing to malicious commits

https://www.aikido.dev/blog/supply-chain-attack-targets-laravel-lang-packages-with-credential-stealer

https://github.com/Laravel-Lang/lang/issues/8295

https://github.com/Laravel-Lang/common/issues/257

https://www.stepsecurity.io/blog/laravel-lang-supply-chain-attack

https://socket.dev/blog/laravel-lang-compromise

#PHP #Laravel #SupplyChainAttack #RemoteCodeExecution #RCE #Packagist

▪ Also patched in legacy Composer 1.10.28 (upgrade to 2.x still recommended)

🚑 Immediate actions:
1️⃣ Run composer.phar self-update NOW
2️⃣ Can't update? Disable #GitHubActions workflows running Composer
3️⃣ Review CI logs for leaked tokens
4️⃣ Delete any log contents containing raw token values before they expire

📦 #Packagist.org is unaffected — no GitHub App involved. #PrivatePackagist applied the fix and audited logs: no tokens were exposed. Self-hosted PP is also unaffected.

▪ Also patched in legacy Composer 1.10.28 (upgrade to 2.x still recommended)

🚑 Immediate actions:
1️⃣ Run composer.phar self-update NOW
2️⃣ Can't update? Disable #GitHubActions workflows running Composer
3️⃣ Review CI logs for leaked tokens
4️⃣ Delete any log contents containing raw token values before they expire

📦 #Packagist.org is unaffected — no GitHub App involved. #PrivatePackagist applied the fix and audited logs: no tokens were exposed. Self-hosted PP is also unaffected.

🚨 Critical Composer Update: 2.9.8 & 2.2.28 fix a GitHub Actions token disclosure!

⚠️ Update NOW or disable GitHub Actions immediately!

https://blog.packagist.com/composer-2-9-8-and-2-2-28-fix-github-actions-token-disclosure-in-error-messages/

#PHP #Composer #ComposerPHP #OpenSource #WebDevelopment #GitHubActions #DevSecOps #CyberSecurity #SoftwareUpdate #PatchRelease #DependencyManagement #SecurityFix #Programming #Packagist #PHPDev #ComposerUpdate #OpenSourceSoftware #WebDevLife #InfoSec #SecurityPatch #CodeSmart #DependencyManagement #SoftwareSecurity #TechUpdate

🚨 Critical Composer Update: 2.9.8 & 2.2.28 fix a GitHub Actions token disclosure!

⚠️ Update NOW or disable GitHub Actions immediately!

https://blog.packagist.com/composer-2-9-8-and-2-2-28-fix-github-actions-token-disclosure-in-error-messages/

#PHP #Composer #ComposerPHP #OpenSource #WebDevelopment #GitHubActions #DevSecOps #CyberSecurity #SoftwareUpdate #PatchRelease #DependencyManagement #SecurityFix #Programming #Packagist #PHPDev #ComposerUpdate #OpenSourceSoftware #WebDevLife #InfoSec #SecurityPatch #CodeSmart #DependencyManagement #SoftwareSecurity #TechUpdate

🚨 Critical Composer Update: 2.9.8 & 2.2.28 fix a GitHub Actions token disclosure!

⚠️ Update NOW or disable GitHub Actions immediately!

https://blog.packagist.com/composer-2-9-8-and-2-2-28-fix-github-actions-token-disclosure-in-error-messages/

#PHP #Composer #ComposerPHP #OpenSource #WebDevelopment #GitHubActions #DevSecOps #CyberSecurity #SoftwareUpdate #PatchRelease #DependencyManagement #SecurityFix #Programming #Packagist #PHPDev #ComposerUpdate #OpenSourceSoftware #WebDevLife #InfoSec #SecurityPatch #CodeSmart #DependencyManagement #SoftwareSecurity #TechUpdate

🚨 Critical Composer Update: 2.9.8 & 2.2.28 fix a GitHub Actions token disclosure!

⚠️ Update NOW or disable GitHub Actions immediately!

https://blog.packagist.com/composer-2-9-8-and-2-2-28-fix-github-actions-token-disclosure-in-error-messages/

#PHP #Composer #ComposerPHP #OpenSource #WebDevelopment #GitHubActions #DevSecOps #CyberSecurity #SoftwareUpdate #PatchRelease #DependencyManagement #SecurityFix #Programming #Packagist #PHPDev #ComposerUpdate #OpenSourceSoftware #WebDevLife #InfoSec #SecurityPatch #CodeSmart #DependencyManagement #SoftwareSecurity #TechUpdate

🚨 Critical Composer Update: 2.9.8 & 2.2.28 fix a GitHub Actions token disclosure!

⚠️ Update NOW or disable GitHub Actions immediately!

https://blog.packagist.com/composer-2-9-8-and-2-2-28-fix-github-actions-token-disclosure-in-error-messages/

#PHP #Composer #ComposerPHP #OpenSource #WebDevelopment #GitHubActions #DevSecOps #CyberSecurity #SoftwareUpdate #PatchRelease #DependencyManagement #SecurityFix #Programming #Packagist #PHPDev #ComposerUpdate #OpenSourceSoftware #WebDevLife #InfoSec #SecurityPatch #CodeSmart #DependencyManagement #SoftwareSecurity #TechUpdate

North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads
#ContagiousInterview #npm #PyPI #Packagist
https://socket.dev/blog/contagious-interview-campaign-spreads-across-5-ecosystems

North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads
#ContagiousInterview #npm #PyPI #Packagist
https://socket.dev/blog/contagious-interview-campaign-spreads-across-5-ecosystems

⚠️ Fake #Laravel packages on #Packagist deploy a cross-platform #RAT on Windows, macOS & Linux — researchers at Socket flagged 3 malicious #PHP packages disguised as Laravel utilities #cybersecurity #supplychain #opensource #infosec

📦 Malicious packages identified:
• nhattuanbl/lara-helper (37 downloads)
• nhattuanbl/simple-queue (29 downloads)
• nhattuanbl/lara-swagger (49 downloads)

🧵 👇

⚠️ Fake #Laravel packages on #Packagist deploy a cross-platform #RAT on Windows, macOS & Linux — researchers at Socket flagged 3 malicious #PHP packages disguised as Laravel utilities #cybersecurity #supplychain #opensource #infosec

📦 Malicious packages identified:
• nhattuanbl/lara-helper (37 downloads)
• nhattuanbl/simple-queue (29 downloads)
• nhattuanbl/lara-swagger (49 downloads)

🧵 👇

I finally solved my Composer hanging/stuck issue 🚀
Set up a local proxy server and routed downloads using PHP stream functions.

Added real-time debugging with log files to trace where it was freezing.

Result: smooth installs, zero guesswork 😌

#PHP #composer #packagist #proxy

I finally solved my Composer hanging/stuck issue 🚀
Set up a local proxy server and routed downloads using PHP stream functions.

Added real-time debugging with log files to trace where it was freezing.

Result: smooth installs, zero guesswork 😌

#PHP #composer #packagist #proxy

The other night I made this little #PHP tool that validates #PHPDoc annotations against the actual method signature, to make sure that they are compatible and don't drift apart over time.

I use it as a quick check before running #PHPStan to make sure that the static analysis is correctly informed. Published it on #Packagist in case anyone else would find it useful too: https://packagist.org/packages/nsrosenqvist/phpdoc-validator

The other night I made this little #PHP tool that validates #PHPDoc annotations against the actual method signature, to make sure that they are compatible and don't drift apart over time.

I use it as a quick check before running #PHPStan to make sure that the static analysis is correctly informed. Published it on #Packagist in case anyone else would find it useful too: https://packagist.org/packages/nsrosenqvist/phpdoc-validator

RE: https://infosec.exchange/@art4/115747129017446982

Just in time for the end of 2025 (at least in my time zone), I released version 1.0.0 of my new #RectorExtension that replaces the native type declaration set. The special thing about it: no breaking changes!

This means: no changes to parameter types or return types if your class/method is not private or final. This is particularly important for library maintainers who want to use #Rector but don't want to have any breaking changes.

If you are a maintainer of a #PHP library and #backwardcompatibility is important to you, then check it out on #packagist:

https://packagist.org/packages/art4/rector-bc-library

Happy new year! 🥳

RE: https://infosec.exchange/@art4/115747129017446982

Just in time for the end of 2025 (at least in my time zone), I released version 1.0.0 of my new #RectorExtension that replaces the native type declaration set. The special thing about it: no breaking changes!

This means: no changes to parameter types or return types if your class/method is not private or final. This is particularly important for library maintainers who want to use #Rector but don't want to have any breaking changes.

If you are a maintainer of a #PHP library and #backwardcompatibility is important to you, then check it out on #packagist:

https://packagist.org/packages/art4/rector-bc-library

Happy new year! 🥳

I'm currently working on a #RectorExtension that replaces the native type declaration set. The special thing about it: no breaking changes!

This means: no changes to parameter types or return types if your class/method is not private or final. This is particularly important for library maintainers who want to use #Rector but don't want to have any breaking changes.

If you are a maintainer of a #PHP library and #backwardcompatibility is important to you, then check it out on #packagist: https://packagist.org/packages/art4/rector-bc-library

And feel free to give me feedback.

I'm currently working on a #RectorExtension that replaces the native type declaration set. The special thing about it: no breaking changes!

This means: no changes to parameter types or return types if your class/method is not private or final. This is particularly important for library maintainers who want to use #Rector but don't want to have any breaking changes.

If you are a maintainer of a #PHP library and #backwardcompatibility is important to you, then check it out on #packagist: https://packagist.org/packages/art4/rector-bc-library

And feel free to give me feedback.

How to use local packages in Composer: a guide for PHP developers

When working on a PHP project, it’s common to rely on external libraries published on Packagist. Composer makes installing and managing these dependencies effortless. But what if you need to work with a dependency locally, outside Packagist?

https://dev.to/robertobutti/how-to-use-local-packages-in-composer-a-guide-for-php-developers-h89

#php #packagist #composer #opensource

Strengthening PHP Supply Chain Security with a Transparency Log for Packagist.org. #PHP #packagist

http://packagist.org/?utm_source=flipboard&utm_medium=activitypub

Posted into SYMFONY FOR THE DEVIL @symfony-for-the-devil-mobileatom

Woot! Abivia Ledger for Laravel passes 25K downloads through Packagist!

This makes it the most popular piece of open source code I've written, ever. Also apparently one of the most bug-free. Just 12 issues on GitHub in over three years, and most of those not related to bugs.

My personal mission to help developers avoid building ill-conceived accounting logic into their applications continues!

#PHP #Laravel #packagist #accounting

Woot! Abivia Ledger for Laravel passes 25K downloads through Packagist!

This makes it the most popular piece of open source code I've written, ever. Also apparently one of the most bug-free. Just 12 issues on GitHub in over three years, and most of those not related to bugs.

My personal mission to help developers avoid building ill-conceived accounting logic into their applications continues!

#PHP #Laravel #packagist #accounting

Packagist.org shutdown of Composer 1.x support postponed to September 1st, 2025. #packagist #composer #php
https://blog.packagist.com/packagist-org-shutdown-of-composer-1-x-support-postponed-to-september-1st-2025/

Packagist.org shutdown of Composer 1.x support postponed to September 1st, 2025. #packagist #composer #php

http://packagist.org/?utm_source=flipboard&utm_medium=activitypub

Posted into SYMFONY FOR THE DEVIL @symfony-for-the-devil-mobileatom

tomkyle/binning – Determine optimal number of bins 𝒌 for #histogram #creation and optimal bin width 𝒉 using various statistical methods in #PHP.

Included methods: Sturges’ Rule, Doane’s Rule, Freedman-Diaconis Rule, Terrell-Scott’s Rule, Rice Rule, Scott’s Rule, and Square Root Rule.

GitHub: https://github.com/tomkyle/binning
Issues: https://github.com/tomkyle/binning/issues

Available on #packagist via #composer. Heavily inspired by markrogoyski/math-php but written for #PHP 8.3+. — #math #statistics

tomkyle/binning – Determine optimal number of bins 𝒌 for #histogram #creation and optimal bin width 𝒉 using various statistical methods in #PHP.

Included methods: Sturges’ Rule, Doane’s Rule, Freedman-Diaconis Rule, Terrell-Scott’s Rule, Rice Rule, Scott’s Rule, and Square Root Rule.

GitHub: https://github.com/tomkyle/binning
Issues: https://github.com/tomkyle/binning/issues

Available on #packagist via #composer. Heavily inspired by markrogoyski/math-php but written for #PHP 8.3+. — #math #statistics

Totally forgot that Laravel News published my new package for modernising the old Laravel Seeder:

https://laravel-news.com/populate

#Laravel #PHP #Programming #Coding #Code #SoftwareDevelopment #WebDevelopment #WebDev #Seeding #Database #SQL #DatabaseDevelopment #RDBMS #Github #Git #SourceCode #Packagist #Composer