Visanduma development branches distributed PolinRider loaders

A package used to add two-factor authentication to Laravel Nova became a distribution route for malware through its development branches. Socket researcher Karlo Zanki reported malicious code in visanduma/nova-two-factor on September 17, tracing the source changes to a compromised Visanduma developer account. The finding concerned development versions, with no malicious stable release identified.

Packagist made those branches available through Composer under names such as dev-main. Consumers following development code could therefore receive an upstream change without a new numbered release. Socket listed dev-main, dev-nova4support, dev-using-inertia, and dev-nova5 as affected. The registry was a route from compromised source to consumers, rather than evidence of a separate Packagist account takeover.

Socket identified altered Tailwind configuration among the payload files and associated the intrusion with PolinRider. Such JavaScript configuration can execute when frontend tooling loads it, giving a PHP project's development process an additional attack surface. The report placed the Visanduma compromise in mid-June, but did not provide a precise initial date.

By the October 30 review, Packagist had frozen the package and explicitly flagged all four development versions as malware. That registry response supplied a concrete containment measure, but did not establish that affected checkouts or developers' machines had been cleaned. The package's cumulative downloads did not measure use of the poisoned branches, and the attacker's reach into private projects remained unknown.