writeups.xyz / PHP Supply Chain Attack on Composer

Submitter : c2a

Date: 29 April 2021

Bounty : undisclosed

Vulnerabilities :

• Argument Injection
• RCE
• Supply Chain Attack
• Security Code Review

Programs :

• Packagist

Authors :

• Thomas Chauchefoin (@Swapgs)

Link :
https://blog.sonarsource.com/php-supply-chain-attack-on-composer/