Packagist removed thirteen malicious Composer themes. A fourteenth from the same operator is still listed.

Thirteen Composer packages were pulled from Packagist over the weekend, after Socket's threat research team published an account of what they were doing: shipping trojanised front-end assets that, on an unpatched iPhone, led to a full WebKit-to-kernel exploit chain and a payload that reads cryptocurrency wallet seeds out of the iOS keychain. Every package the researchers named now returns a 404.

That is the story as it has been told. It is accurate, and it is a much smaller fact than it sounds, because a fourteenth package from the same operator is still listed, still installable, and was named in the research as a sleeper.

Every line below was checked by hand on 1 September 2026, against a control package so that a registry outage could not be mistaken for a takedown.

What the takedown removed, and what it did not

The fourteenth package

vsmov1/theme-themphim resolves on Packagist right now. Version 1.0.1, published on 27 August 2026, maintained by the account vsmov, author email vsphim@vsphim.com, zero downloads. It points at github.com/vsmov/theme-themphim, a repository created on the same day. The vendor name differs from the pulled vsmov namespace by a single character.

Socket named this package. Under the heading of sleeper risk, the report says theme-themphim was "published alongside the malicious theme-thempho" and "ships the same ionCube-encrypted account system as opaque bytecode from the same operator that ships confirmed spyware delivery", and it recommends treating any package from vsmov, vsphim, haiau009, chilltvcms or ophimcms accordingly. Four of those five namespaces are now empty. The one holding the sleeper is not one of them, because it is spelled differently.

Two things about that package are worth stating precisely, because they are the difference between a suspicion and a finding.

Its JavaScript is currently clean. All three shipped script files, including the bundled jQuery, contain no reference to navigator.platform, no reference to document.referrer and no call to atob. Those are the three signatures of the loader in the packages that were removed. On the evidence of the assets it ships today, this package does not deliver the exploit chain.

Its PHP is unreadable. ThemeThemPhimServiceProvider.php and Controllers/ThemeThemphimController.php both begin <?php //ICB0, the ionCube loader header, and between them run to just over 100 kilobytes of bytecode. Nobody outside the operator knows what that code does. It is the account system: registration, login, OAuth, password change. Credentials post into a handler that cannot be read.

And the theme's own layout.blade.php renders two stored settings into every page with Laravel's unescaped output syntax, {!! !!}: a footer field and a scripts field. Socket makes the general point about this theme family, and it holds here specifically. An operator, or anyone who reaches the administration panel, can put arbitrary JavaScript on every page of the site without publishing a new release and without touching the repository. There is nothing for a lockfile, an audit or a composition scanner to notice, because nothing in the package changes.

Removal from a registry is not removal of the code

The loader is still on GitHub. ophimcms/theme-dy was one of the thirteen. Its Packagist listing is gone. Its repository is not: the master branch still carries a 94,436 byte resources/assets/templets/js/jquery.js with the malicious block appended after the library's closing function. The obfuscated entry point is there. The platform and referrer gate is there. A base64 blob is there, and decoding it gives https://union.macoms.la/jquery.min-3.6.8.js, the first stage.

Composer does not require Packagist. A repositories entry of type vcs pointing at a Git URL installs the package directly, and a good deal of the CMS theme market moves that way already, through vendor-supplied instructions rather than the public registry. A takedown closes the default route. It does not close that one, it does not affect any site that installed the theme before the takedown, and it does not remove anything from the machine the code is already on.

This is the part of the story a site operator has to act on, and it is the part the coverage has been quietest about.

How a PHP package reaches an iPhone

The chain is easy to state wrongly, so here it is plainly. The PHP never touches the phone, nothing is injected at build time, and the server is not the target.

OphimCMS and KKPhim are Laravel-based content management systems used to run Vietnamese-language streaming sites. An operator installs a theme with Composer. The theme's job is to ship the site's front-end assets, and the malicious code rides in those assets rather than in the PHP. From that point every visitor to the site is served the trojanised script.

The script gates itself. It fires only where navigator.platform does not match Mac or Windows and where the visitor arrived with an external referrer, which passes over desktop users, bots and anyone typing the address directly. Every mobile visitor that clears the gate gets a gambling redirect. iPhone visitors get a second branch: a chain of loaders, one of them on a domain built to be mistaken for Cloudflare, ending in a hidden iframe that reads the iOS version out of the user agent and loads a WebKit exploit matched to that build.

What follows is renderer compromise inside the browser sandbox, a pivot into the GPU process, and a kernel escape through an IOKit driver, at which point the payload reads the keychain. Socket's analysis puts five keychain query routines covering seven wallet apps, alongside collection of Wi-Fi passwords, the SMS database, contacts, Photos, cookies, location history and account databases.

The site operator is a victim in this too, and generally an unwitting one. Their server is not compromised. They are simply serving the attack to everyone who visits.

Every stage was patched before the campaign was rebuilt

This matters more than any other technical detail, because it changes who is exposed and what they should do.

Nothing here is a zero-day

Stage	Flaw	Apple fixed it	Before the chain was rebuilt
Renderer entry	CVE-2025-31277, WebKit	29 July 2025, in iOS 18.6	More than twelve months
Renderer entry	CVE-2025-43529, WebKit	12 December 2025, in iOS 18.7.3 and iOS 26.2	Eight months
Kernel escape	No CVE assigned	3 November 2025, in iOS 26.1	Nine months

Both WebKit identifiers are in CISA's Known Exploited Vulnerabilities catalogue. Socket reports that the rebuilt chain still weaponises only those two, and that its offset tables still cover only iOS 18.4 through 18.6.x, with nothing for iOS 18.7 or iOS 26.

So the exposure statement is unusually clean. At risk: an iPhone XS through iPhone 16 left on iOS 18.4 to 18.6.x. Not exposed to the known stages: iOS 18.7.3 or later on the 18 line, or iOS 26.2 or later. An operating system update closes this entirely, which is not something one can often say.

The numbers that do not exist

Several of the figures circulating with this story are not in the research.

There is no install count for the thirteen packages. Socket did not publish one, and now that the listings are deleted the download totals are not recoverable from the registry. The only install figure anywhere in Socket's work on this operator is roughly 2,750 across the six ophimcms packages in their March report, which is a different and smaller set.

There is no count of affected websites, no count of victims, and no figure for cryptocurrency stolen. There are no wallet addresses and no on-chain tracing. The seed-stealing capability is documented from the code, which is solid; no theft is evidenced, which is a different claim.

The $200 million figure that travels with the name FUNNULL is real but belongs to something else. It comes from the US Treasury's designation of Funnull Technology Inc and its administrator Liu Lizhi on 29 May 2025, and it refers to victim-reported losses from cryptocurrency investment scam websites hosted on that infrastructure. Treasury's own wording is that Funnull "has directly facilitated several of these schemes, resulting in over $200 million in U.S. victim-reported losses". It is not a measure of this campaign.

What to do

For phones the instruction is simply the update. iOS 18.7.3 on the 18 line, or iOS 26.2 and later, closes every stage of this chain as it is currently built.