On 31 August 2026, Socket's threat research team reported 13 malicious Composer theme packages on Packagist, built for OphimCMS and KKPhim, two Laravel-based CMSes used by Vietnamese movie and comic streaming sites. The themes injected JavaScript into every page of the sites that installed them. Mobile visitors got ad fraud and gambling redirects. Visitors on iPhones running iOS 18.4 to 18.6.x got a WebKit-to-kernel exploit chain that installed spyware, with a newer payload aimed at crypto wallet seeds.
What's affected
The 13 packages, across five vendor namespaces:
| Vendor | Packages |
|---|---|
vsmov | theme-dy, theme-rrdyw, theme-motchill, theme-vsmov |
vsphim | theme-heovl, theme-thempho |
haiau009 | kkphim-legend, kkphim-motchill |
chilltvcms | theme-legend |
ophimcms | theme-dy, theme-motchill, theme-pcc, theme-rrdyw |
When we queried Packagist's API on 18 October, all 13 returned 404.
The malicious code sits in front-end theme JavaScript, not in PHP. Socket gives examples: theme-dy appends a loader after the shipped jQuery, theme-rrdyw injects through indexbottom.js and topinfo.js, theme-motchill and theme-vsmov carry an MPAd class in functions.js that loads remote scripts, and theme-thempho hides its injection in js.cookie.js. Socket also found dormant packages from the same vendors and admin "Custom JS" fields rendered unescaped on every page, so a theme could be armed later through an update or a settings change.
On the device side, Socket reports that a hidden iframe checks the iOS version and picks an exploit. It uses CVE-2025-31277 for iOS 18.4 to 18.5 and CVE-2025-43529 for 18.6 and later, then escapes to the kernel through the AppleM2ScalerCSCDriver IOKit interface. Apple fixed the WebKit entry points in iOS 18.7.3 and 26.2, and Apple told Socket the kernel escape was already fixed in iOS and macOS 26.1. The spyware collects keychain data, messages, photos and cookies, and the August redeployment added theft of seeds and mnemonics for wallets including Bitget, Phantom, Tonkeeper and Trust Wallet.
Socket first documented this operation in March 2026, when six packages posed as OphimCMS themes.
How to check if you're exposed
If you run a PHP site, check the lock file and vendor directory for any package from the five vendors. Socket advises treating every package from them as untrusted, not only the 13:
grep -nE '"name": "(vsmov|vsphim|haiau009|chilltvcms|ophimcms)/' composer.lock
ls vendor/ | grep -E '^(vsmov|vsphim|haiau009|chilltvcms|ophimcms)$'
Then search deployed static assets for the published network indicators. Themes often copy their assets into public/, so a removed package can leave the injected files behind:
grep -rnE 'macoms\.la|data-29(19|20)\.com|cloudfareintcdn|ue8im\.com|cre-ads\.com|rce_locked' public/ resources/ vendor/ 2>/dev/null
Also check the database for the CMS's "Custom JS" or similar settings fields, since those render on every page and can carry the same loaders without a theme update.
For people rather than servers: an iPhone on iOS 18.7.3 or later, or 26.2 or later, is outside the known chain. Anything on 18.6.x or older should be updated.
What to do now
- Remove every package from the five vendors, including ones that look inactive, and redeploy from a clean build so leftover public assets go too.
- Clear injected settings. Empty and review any custom JavaScript or HTML fields in the CMS admin, and lock down who can edit them.
- Rotate credentials handled on the host: database, admin accounts, deploy keys and any API keys in
.env. - Add a Content Security Policy that restricts
script-srcto your own origins. It would have blocked the remote loaders even with the theme installed. - Tell your users if you ran one of these themes. Visitors on old iPhones were the real targets. Advise them to update iOS and, if they use a crypto wallet on that phone, to move funds to a new wallet.
Why it matters
Most supply chain writing focuses on developers who install a bad package. Here the developer is a delivery vehicle, and the victims are anonymous visitors to the sites that installed the package. The site operator installs a theme, the theme ships JavaScript, and the browser runs it with the site's own origin and reputation.
The other lesson is about where to look. Composer and PHP review tools focus on PHP. These themes kept PHP clean and put the payload in minified JavaScript and a renamed CryptoJS bundle. If you install themes, plugins or templates from a registry, inventory the front-end assets they ship along with the server code, and know which vendor each one came from.
Try it yourself
Generate a dependency inventory for one PHP application and sort it by vendor. For each vendor, note whether it is an organisation you recognise, how many maintainers it has, and whether the package ships JavaScript into your public directory. Packages that ship front-end code from a vendor you can't identify belong at the top of the review list.
Click through it at your own pace, or open it full screen.
Quick check
Who was the main target of these Packagist themes?
Visitors to the streaming sites that installed them. The site operators unknowingly served injected JavaScript, and unpatched iPhones received the exploit chain.
Which iOS versions does Socket list as outside the known exploit chain?
iOS 18.7.3 and later on the 18 line, and iOS 26.2 and later. Apple fixed the kernel escape in 26.1.
Why isn't removing the 13 packages enough?
Assets may remain in the public directory, dormant packages from the same vendors can be armed later, and the CMS's custom JavaScript fields can carry loaders without any package.
