6 malicious OphimCMS themes on Packagist ship a trojanised jQuery

MediumMalicious packagePackagist

Six Composer packages from the ophimcms organisation posed as OphimCMS themes containing trojanised jQuery. The payload exfiltrates URLs, injects ads, and redirects mobile traffic via OFAC-sanctioned FUNNULL infrastructure. Combined ~2,750 installs.

Published 12 Mar 2026

Scan a lockfile Source advisory

At a glancepackagist-2026-03-12-ophimcms-themes

Packages tracked6 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity: Medium
Type: Malicious package
Published: 12 Mar 2026
Ecosystems: Packagist
Detected by: Socket
Source: socket.dev

Malicious package. A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.

What happened

The full picture

Six Composer packages published under the ophimcms Packagist organisation impersonated themes for OphimCMS, a Vietnamese-language movie-streaming CMS. Each shipped a trojanised copy of jQuery whose extra code phones home with the visiting URL, injects ad markup, and conditionally redirects mobile browsers to gambling and adult sites.

The combined install count across the six packages was roughly 2,750, modest in absolute terms but high-impact because every install translates into a live theme on a public web property. Affected packages include ophimcms/theme-dy, ophimcms/theme-mtyy, ophimcms/theme-rrdyw, ophimcms/theme-pcc, ophimcms/theme-motchill, and ophimcms/theme-legend.

Redirect and telemetry traffic terminates at infrastructure operated by FUNNULL, a CDN provider sanctioned by the U.S. Treasury OFAC in 2025 for facilitating pig-butchering scam infrastructure. The hardcoded callouts include:

union.macoms.la - URL telemetry collector
userstat.net - secondary beacon
cre-ads.com - ad / redirect orchestrator

The trojanised jQuery files are byte-identical to legitimate jQuery for most of their length, so naive diff-based reviews against a stock vendor copy miss the appended payload. Socket flagged the org publicly on 2026-03-12.

cdn-supply-chainobfuscationdormant-domain

Affected packages

6 packages 6 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Scan a lockfile →

Impact

What it does if you installed it

Visitors to sites using these themes get redirected to gambling / adult content
URL telemetry exfiltrated to attacker domains
Uses OFAC-sanctioned FUNNULL hosting infrastructure

What to do

Clean-up steps

Remove all ophimcms/theme-* packages from Composer projects
Block listed FUNNULL domains at the perimeter (union.macoms.la, userstat.net, cre-ads.com)

References

Sources

packagist-2026-03-12-ophimcms-themesBack to incidents Submit a correction

Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Scan a lockfile All incidents