VYPR
← All malware advisories

composer · Malicious package advisory

Malware

composer/composer

PKG-PKSA-ym19-cy3j-z6df

Composer arbitrary command execution via a malicious package's Perforce source URL

Details

**CVE:** [CVE-2026-84361](/cves/CVE-2026-84361)

**Severity:** High

**Affected versions:** >=1.0,<2.2.30|>=2.3.0,<2.10.3

**Source:** [GitHub](https://github.com/advisories/GHSA-rvx4-ffvw-m9q3)

**Remote ID:** GHSA-rvx4-ffvw-m9q3

Compromised versions (1)

  • >=1.0,<2.2.30|>=2.3.0,<2.10.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.