6 malicious Packagist OphimCMS themes ship trojanised jQuery and FUNNULL redirects

What happened

Six Composer packages published under the ophimcms Packagist organisation impersonated themes for OphimCMS, a Vietnamese-language movie-streaming CMS. Each shipped a trojanised copy of jQuery whose extra code phones home with the visiting URL, injects ad markup, and conditionally redirects mobile browsers to gambling and adult sites.

The combined install count across the six packages was roughly 2,750, modest in absolute terms but high-impact because every install translates into a live theme on a public web property. Affected packages include ophimcms/theme-dy, ophimcms/theme-mtyy, ophimcms/theme-rrdyw, ophimcms/theme-pcc, ophimcms/theme-motchill, and ophimcms/theme-legend.

Redirect and telemetry traffic terminates at infrastructure operated by FUNNULL, a CDN provider sanctioned by the U.S. Treasury OFAC in 2025 for facilitating pig-butchering scam infrastructure. The hardcoded callouts include:

• union.macoms.la — URL telemetry collector
• userstat.net — secondary beacon
• cre-ads.com — ad / redirect orchestrator

The trojanised jQuery files are byte-identical to legitimate jQuery for most of their length, so naive diff-based reviews against a stock vendor copy miss the appended payload. Socket flagged the org publicly on 2026-03-12.

Affected packages (6)

Impact

• Visitors to sites using these themes get redirected to gambling / adult content
• URL telemetry exfiltrated to attacker domains
• Uses OFAC-sanctioned FUNNULL hosting infrastructure

What to do

1. 1Remove all ophimcms/theme-* packages from Composer projects
2. 2Block listed FUNNULL domains at the perimeter (union.macoms.la, userstat.net, cre-ads.com)

References

• 6 Malicious Packagist Themes Ship Trojanized jQuery

  socket.dev
  Socket
• Treasury Sanctions FUNNULL Technology and Administrator

  home.treasury.gov
  U.S. Treasury
• Packagist: ophimcms organisation

  packagist.org
  Packagist