Malicious packages on public registries

Thirteen Packagist themes push mobile ad-fraud, with an iPhone-only kernel exploit chain

Socket found thirteen trojanized Composer themes across five vendor namespaces, and the front-end assets those packages ship carry an iPhone exploit chain out to the mobile visitors of every site that installs one.