Attackers injected malicious code into eight PHP packages on the Packagist registry, exploiting a cross-ecosystem gap where PHP projects also run npm for frontend tooling. When any developer or automated build pipeline runs ‘npm install’, the malicious hook silently downloads and executes a Linux binary on the build host, before any application-level or build-time controls can intervene. Organizations using the affected packages in development or CI/CD pipelines are at risk of compromised build infrastructure, credential theft from build environments, and potential propagation into production deployments.