Embedded Malicious Code Affecting intercom/intercom-php package, versions =5.0.2
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-INTERCOMINTERCOMPHP-16329836
- published1 May 2026
- disclosed29 Apr 2026
- creditPeter van der Zee
Introduced: 29 Apr 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the intercom/intercom-php package.
Overview
intercom/intercom-php is an Intercom API client.
Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload. A malicious actor compromised the package, enabling the attacker to publish tampered versions of the deep learning framework.
Malicious Behavior
The execution chain runs automatically on module import through a daemon thread with suppressed output. A preinstall script is added that downloads the Bun JavaScript runtime from GitHub to execute an 11 MB obfuscated JavaScript payload (router_runtime.js). The malware actively steals and exfiltrates developer tokens, environment variables, and cloud-related secrets.