{"uuid": "9024478f-c370-4d61-9e31-8c43a54567a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-gr3r-crp5-qrrm", "type": "seen", "source": "https://gist.github.com/alon710/56ddf2e902ba484e9ffc934e550f18ab", "content": "# GHSA-GR3R-CRP5-QRRM: GHSA-GR3R-CRP5-QRRM: Supply Chain Compromise in intercom-php via Malicious Composer Plugin\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-05-07\n> **Full Report:** https://cvereports.com/reports/GHSA-GR3R-CRP5-QRRM\n\n## Summary\nThe intercom/intercom-php package on Packagist was subjected to a supply chain compromise by the TeamPCP threat actor group. Attackers published a malicious package version (5.0.2) utilizing a Composer plugin to achieve arbitrary code execution upon installation, resulting in the exfiltration of environment variables and sensitive credentials to an external command-and-control server.\n\n## TL;DR\nA malicious version (5.0.2) of the intercom/intercom-php package was published via a compromised GitHub tag. It uses a malicious Composer plugin to automatically execute code during installation, exfiltrating local secrets and environment variables. All organizations that installed this version must immediately rotate all potentially exposed credentials.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-506 / CWE-912\n- **Attack Vector**: Supply Chain / Malicious Package\n- **CVSS Score**: 10.0 (Critical)\n- **Execution Context**: Composer Plugin Lifecycle\n- **Primary Impact**: Credential Exfiltration\n- **Exploit Status**: Active Exploitation (Remediated)\n\n## Affected Systems\n\n- Packagist PHP Ecosystem\n- Composer Package Manager Runtime\n- Developer Workstations\n- CI/CD Pipelines\n- **intercom/intercom-php**: 5.0.2 (Fixed in: `Removed from registry; use alternative verified versions.`)\n\n## Mitigation\n\n- Strict Dependency Pinning and Lockfile Enforcement\n- Comprehensive Credential Rotation\n- Network Egress Filtering for CI/CD Runners\n- Enforcement of Two-Factor Authentication (2FA) for Maintainers\n\n**Remediation Steps:**\n1. Audit all projects for the presence of intercom/intercom-php version 5.0.2 in composer.json or composer.lock.\n2. Immediately downgrade or upgrade the package to a verified, safe version.\n3. Identify all systems (developer laptops, build servers) where composer install or composer update was executed while 5.0.2 was in the dependency tree.\n4. Rotate all credentials, API keys, database passwords, and cloud tokens accessible in the environment variables or local files of the affected systems.\n5. Review access logs for cloud infrastructure and internal services for unauthorized access originating after the time of potential compromise.\n\n## References\n\n- [GitHub Advisory: GHSA-gr3r-crp5-qrrm](https://github.com/advisories/GHSA-gr3r-crp5-qrrm)\n- [Intercom Status History](https://www.intercomstatus.com/history)\n- [Socket Blog - Mini Shai-Hulud Packagist Compromise](https://socket.dev/blog/mini-shai-hulud-packagist-malicious-intercom-php-package-compromise)\n- [Wiz Analysis of TeamPCP Campaign](https://www.wiz.io/blog/mini-shai-hulud-supply-chain-sap-npm)\n- [Incident Timeline // TeamPCP Supply Chain Campaign](https://ramimac.me/teampcp/)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-GR3R-CRP5-QRRM) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-07T17:10:29.000000Z"}