hautelook/phpass hijacked through GitHub organization

hautelook/phpass failed through namespace reuse. The original GitHub organization was deleted after the project moved, but the Packagist package still pointed at the old repository path. An attacker registered the abandoned organization name and recreated the phpass repository.

Composer and Packagist trusted the coordinate. Installers resolving hautelook/phpass could fetch from the attacker's repository because the URL still matched the package metadata. No source forge was needed; the abandoned namespace became the source.

The malicious replacement carried code to collect environment data and secrets. Concrete CMS traced exposure through dependency resolution and published a replacement package while Packagist and GitHub removed the hostile repository.

This differs from a typosquat. The package name was established, and the attacker took over the exact upstream location that package metadata still referenced. The failure was stale ownership on an official dependency path.

Motive

Credential Theft

Attribution

Person

Cause

Abandoned Namespace Takeover

Transitive

No

Actor

Sockpuppets

• Supply chain hack phpass repo jackingconcretecms.org
• Supply Chain Attack: CTX Account Takeover and PHPass Hijack Explainedorca.security
• Detecting Poisoned Python Packages: CTX and PHPasscrowdstrike.com
• PyPI Package 'ctx' and PHP Library 'phpass' Compromised to Steal Environment Variablessonatype.com
• PyPI package ctx and PHP library phpass compromisedthehackernews.com
• Attackers compromised PyPI package to steal AWS keyscybersecuritynews.com