Magento extension vendors shipped license backdoors

This is not a generic Magento backdoor record. Magento is an ecosystem, and most Magento malware reaches stores through stolen admin credentials, old vulnerabilities, uploaded webshells, or injected checkout JavaScript. This record is narrower: Sansec found vendor-distributed extension packages that already carried the same PHP backdoor.

The confirmed supply-chain scope covered Tigren, Meetanshi, and Magesolution (MGS). Sansec identified 21 affected modules published between 2019 and 2022, and reported that the vendor download servers had been breached. A Weltpixel GoogleTagManager package looked suspicious too, but Sansec could not establish where it had been altered.

The inserted code posed as license logic. A fake License.php or LicenseApi.php file was loaded from registration.php, and adminLoadLicense executed attacker-controlled $licenseFile content as PHP. Older 2019 variants did not require authentication; later variants added vendor-specific keys such as requestKey and dataSign checks.

The code stayed quiet for years. Sansec reported active use since at least 2025-04-20 and estimated that 500 to 1,000 stores were running affected software, including one large multinational. Vendor response was uneven: Meetanshi confirmed a server hack while disputing package tampering, Tigren denied compromise, and MGS did not respond.