{"id":"MAL-2026-3637","aliases":[],"title":"Malicious code in intercom-php (Packagist)","titleSource":"OSV","descriptionSource":"OSV","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (0bd33abd6fda35e856f8346fda5e85913ce2cad6b4d6c315a2e7138b867760aa)\nThis package is malicious and was compromised as part of the Mini Shai-Hulud campaign by the TeamPCP threat actor.\nThe malicious payload steals credentials, and can propogate to NPM packages using credentials it finds.\n","severity":"unknown","score":null,"published":"2026-05-13T03:14:00.000Z","modified":"2026-08-19T06:15:08.711Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"intercom/intercom-php","sources":[{"name":"OSV · MAL-2026-3637","url":"https://osv.dev/vulnerability/MAL-2026-3637"}],"ranges":[],"versions":["5.0.2"],"fixed":[]}],"sourceAffected":[],"references":["https://socket.dev/blog/mini-shai-hulud-packagist-malicious-intercom-php-package-compromise","https://semgrep.dev/blog/2026/malicious-intercom-php-package-spreads-mini-shai-hulud-attack-to-packagist-via-composer-plugin/","https://github.com/advisories/GHSA-gr3r-crp5-qrrm"],"sources":[{"name":"OSV","id":"MAL-2026-3637","modified":"2026-08-19T06:15:08.711627464Z","url":"https://osv.dev/vulnerability/MAL-2026-3637"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-28T19:05:34.210Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}