hautelook/phpass hijacked through GitHub organization

hautelook/phpass failed through namespace reuse. The original GitHub organization was deleted after the project moved, but the Packagist package still pointed at the old repository path. An attacker registered the abandoned organization name and recreated the phpass repository.

Composer and Packagist trusted the coordinate. Installers resolving hautelook/phpass could fetch from the attacker's repository because the URL still matched the package metadata. No source forge was needed; the abandoned namespace became the source.

The malicious replacement carried code that read two hardcoded environment variables, AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Packagist administrators redirected users to a pre-existing clean fork, and Concrete CMS advised moving to PHP's built-in password hashing while Packagist and GitHub removed the hostile repository.

This differs from a typosquat. The package name was established, and the attacker took over the exact upstream location that package metadata still referenced. The failure was stale ownership on an official dependency path.