—

MAL-2026-3637

Malicious code in intercom-php (Packagist)

Details

--- _-= Per source details. Do not edit below this line.=-_

## Source: google-open-source-security (0bd33abd6fda35e856f8346fda5e85913ce2cad6b4d6c315a2e7138b867760aa) This package is malicious and was compromised as part of the Mini Shai-Hulud campaign by the TeamPCP threat actor. The malicious payload steals credentials, and can propogate to NPM packages using credentials it finds.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist / intercom/intercom-php

No fixed version published yet for intercom/intercom-php (composer). Pin to a known-safe version or switch to an alternative.

References

https://socket.dev/blog/mini-shai-hulud-packagist-malicious-intercom-php-package-compromise [ARTICLE]
https://semgrep.dev/blog/2026/malicious-intercom-php-package-spreads-mini-shai-hulud-attack-to-packagist-via-composer-plugin/ [ARTICLE]
https://github.com/advisories/GHSA-gr3r-crp5-qrrm [ADVISORY]