Loading today’s stories
Build1 distinct publisher2 min readPublished
Socket found thirteen trojanized Composer themes across five vendor namespaces, and the front-end assets those packages ship carry an iPhone exploit chain out to the mobile visitors of every site that installs one.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
Two branches, two different mobile tests. The banner code in `indexbottom.js` and the ADTOPLB plugin in `topinfo.js` builds its ad element only when the user agent matches iPhone, iPod, Android or ios, and points it at `23[.]225[.]52[.]67:4466/vip344.html` [16]. That host meta-refreshes to a second IP, sets a session cookie, and forwards to a randomized `.vip` subdomain on port 7740 [17]. The iOS branch is fussier. Its loader in theme-dy is appended after the shipped jQuery and fires only when `navigator.platform` fails a regex anchored on Mac or Win, and when `document.referrer` contains a dot [11]. A laptop opening the site from a typed URL fails both halves of that condition. The targeting is more carefully scoped than most feature flags I have shipped.
The loader also skips `atob` in favour of a hand-rolled base64 decoder [12], so a scan of the theme's assets for the usual obfuscation primitive comes back clean. The encoded argument resolves to `union[.]macoms[.]la/jquery.min-3.6.8.js` [13], which injects `cdn[.]data-2920[.]com/app.vue.js`, which redirects to `www[.]cloudfareintcdn[.]com/in-static.js` [14]. Every filename in that chain is dressed as an ordinary vendor asset, which is also where it lives: the theme ships jQuery, sliders, players and site scripts, and the operator pulls the lot with one `composer require` [8]. Socket attributes the second stage to FUNNULL infrastructure [15].
Package names are no help either. In Socket's list, theme-dy, theme-motchill and theme-rrdyw each appear under two different vendors [2], and vsmov plus ophimcms account for eight of the thirteen [3]. The forks keep the scaffolding intact and leave the upstream author handle sitting inside the code [9]. Measured against the six packages under one vendor in March, that is seven more packages and four more namespaces now confirmed [1].
Whether this reaches your users depends on conditions you can actually check. Your browser-executed assets have to arrive from a Composer package rather than a build you control [8], which is the normal arrangement for OphimCMS and KKPhim, the Laravel-based PHP systems these forks target [7]. Your traffic has to be mobile and arrive with a referrer, since desktop browsers, bots and direct visits are passed over [10]. And the handset has to be behind iOS 26.1: Apple told Socket the kernel escape was already fixed in iOS and macOS 26.1 before the report landed [5], and both WebKit entry points are public and listed in CISA's Known Exploited Vulnerabilities catalog [6].
The first of those conditions is the one a server team owns, and it is decided once, in a lockfile, by whoever needed a theme quickly. The blast radius sits on the other side of the HTTP response.
Ranked by verification strength, evidence, and original report placement.
Socket's Threat Research Team found 13 malicious Composer theme packages on Packagist, published across five vendor namespaces, that inject JavaScript into every page of the Vietnamese movie and comic streaming sites that install them.
The injected code runs two operations against a site's visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware; Socket says the chain steals device data and wallet seeds.
Socket reported the iOS chain to Apple and coordinated disclosure, and Apple confirmed the kernel escape was already fixed in iOS and macOS 26.1 before Socket's report.
The two WebKit entry points used by the chain are public and listed in CISA's Known Exploited Vulnerabilities catalog.
OphimCMS and KKPhim are open source PHP content management systems, built on Laravel, used to run Vietnamese-language movie and comic streaming sites.
A site operator installs a core package plus a theme with composer require, and the theme ships the site's front-end assets: jQuery, sliders, players, and site scripts.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 31, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
build
Rewritten tags beat your pin: what laravel-lang says about Composer trust1 distinct publisher
build
Four clocks, one number: what a Laravel credits package takes out of usage billing1 distinct publisher
invest
Your Landed Cost Is Being Litigated By Companies With $306,000 Problems1 distinct publisher
science
TeamPCP hid its infostealer inside the scanners that audit everyone else's code1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Forensically specific, entirely first-party
The mechanics here are hard to wave away: Socket prints the guard regex, the base64 argument that decodes to union.macoms.la, the banner-building code with its user-agent test, the IOKit user client and selector, even per-chipset offset tables spanning the iPhone XS to the 16 family. That is the kind of detail that invites checking. The arithmetic, though — thirteen packages, five namespaces — and Apple's confirmation both rest on the finder's word, and no second party in this reporting has opened the packages.
Spread is visible, uptake is not
The campaign is plainly alive: six themes under one vendor in March became thirteen under five, theme-legend reappeared under two fresh handles, and the exploit ships version- and chipset-specific offsets rather than a proof of concept. What no one counts is the far side of the install. Not one download figure, not one named streaming site, no estimate of mobile visitors served the loader — the reach of a Packagist theme is exactly the number this reporting leaves blank.
Wallet seeds in the headline, patched bugs in the timeline
Read the title and you are looking at iOS spyware stealing crypto wallet seeds. Read four sentences further, in Socket's own words, and the kernel escape was already fixed in iOS and macOS 26.1 before disclosure, with both WebKit entry points patched and catalogued by CISA. The residual exposure is narrow: an iPhone left on iOS 18.4 through 18.6.x arriving at a Vietnamese streaming site from an external link. The unglamorous branch — a mobile ad banner into a gambling redirect, which needs no exploit whatsoever — is what most site operators are actually hosting, and it gets the smaller billing.
The finding is also the sales pitch
Socket discovered these packages, Socket published them, and Socket sells the registry scanning that would have flagged them — the research and the product argument arrive in one document, on the company's own blog, as a sequel to its own March report. Pulling the other way: the disclosure went to Apple first and coordinated, and the vulnerability identifiers are tied to a public catalog rather than left as vendor-only assertions. Self-interested, but not self-serving in a way that dodges verification.
Internally solid, externally unchecked
Two things hold this up: the account is continuous with Socket's March findings on the same FUNNULL infrastructure, and the vulnerability identifiers can be checked against public catalogs by anyone who cares to. Two things hold it down: a single publisher, and the story's most quotable elements — Apple's confirmation, the exact package tally, the attribution of the redirect hosts — resting on that publisher alone.