Malicious PHP Packages on Packagist Target Outdated iPhones to Steal Crypto Wallet Recovery Phrases

Security researchers have found 13 malicious packages in Packagist, the central online library for PHP code. PHP is a widely used programming language that runs behind the scenes on web servers, powering everything from small blogs to large online stores. The packages are designed to target iPhones that have not been updated with the latest security patches, with the specific objective of stealing crypto wallet seeds. A crypto wallet seed, often called a recovery phrase or mnemonic, is a series of words that acts as a master key. Anyone who has this seed can take control of the wallet and move all the cryptocurrency it holds.

The exact technical mechanism is not spelled out in the public report, but such attacks typically follow a familiar pattern. Malicious packages are uploaded to a code repository with names that look similar to popular, legitimate libraries. A developer who adds one of these packages to a website's codebase unwittingly includes malicious instructions on their server. When a visitor loads the website, the server can send a small piece of code to the visitor's browser. If that visitor is using an iPhone with known security flaws that have already been fixed by Apple but not installed, the code may be able to exploit one of those flaws to read sensitive data from the phone, such as information stored by crypto wallet apps or text that has been copied to the clipboard, where seed phrases are sometimes pasted.

For website owners and IT teams, this is a reminder that software dependencies are a critical part of the security chain. A website is only as secure as the libraries it uses. Even a small, rarely updated plugin can become a doorway for attackers to reach every visitor. The discovery of 13 malicious packages on Packagist underlines why it is essential to keep an inventory of all PHP packages in use, update them regularly, and remove any that are no longer maintained.

iPhone users can take immediate steps to reduce the risk. The most important action is to install the latest iOS update as soon as Apple releases it, because these updates close the exact security holes that such attack code looks for. Users should also avoid storing crypto wallet seeds anywhere on a phone, including in notes, screenshots, or the clipboard. A hardware wallet, a small dedicated device that keeps the seed offline, is a stronger option for anyone holding significant amounts of cryptocurrency. Finally, no legitimate website or support agent will ever ask you to enter your seed phrase. If a site asks for it, close the page immediately.

For businesses that run websites, a managed hosting environment can help by automating some of this dependency hygiene. AEU Hosting provides managed WordPress hosting with security built in end to end, including automated updates and monitoring that can help detect and block malicious PHP packages before they are used against visitors. While no service can guarantee complete protection against every supply chain attack, keeping the underlying software current is one of the most effective defenses available.