{"answers":{"affected":"2 open source packages ship an affected version, including intercom/intercom-php.","exploited":"There is no known exploitation of GHSA-gr3r-crp5-qrrm in the wild and no public exploit code.","fix":"No fix has been published for GHSA-gr3r-crp5-qrrm yet. Limit exposure of the affected software until one is available.","what":"GHSA-gr3r-crp5-qrrm is a vulnerability in intercom/intercom-php, published on 7 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-gr3r-crp5-qrrm and fix it if it is affected.\n\nWhat it is: GHSA-gr3r-crp5-qrrm is a vulnerability in intercom/intercom-php, published on 7 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-gr3r-crp5-qrrm in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- intercom/intercom-php (Packagist): affected all versions; no fix listed\n- intercom/intercom-php (Packagist): affected all versions; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-gr3r-crp5-qrrm/ (Markdown: https://insights.sbomify.com/GHSA-gr3r-crp5-qrrm/index.md)","id":"GHSA-gr3r-crp5-qrrm","markdown":"https://insights.sbomify.com/GHSA-gr3r-crp5-qrrm/index.md","name":"GHSA-gr3r-crp5-qrrm","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"PHP Intercom library","requires_auth":"none","summary":"A compromised tag in the intercom-php library allowed attackers to harvest cloud credentials and secrets from developer environments.","user_interaction":"not_required","vuln_class":"supply_chain"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nOn April 30, 2026, a malicious commit was pushed to the intercom/intercom-php repository and tagged as version 5.0.2, using a compromised service account (github-management-service). This occurred as part of the same supply chain attack that affected intercom-client on npm.\n\nThe malicious version contained a Composer plugin that acted as a dropper, downloading the Bun JavaScript runtime (version 1.3.13) and executing an obfuscated credential-harvesting payload. The payload targeted cloud provider credentials (AWS, GCP, Azure), environment variables, .env files, SSH keys, local configuration files, and CI/CD secrets.\n\nThe malicious tag was live between approximately 20:53 UTC and 22:37 UTC on April 30, 2026, before being identified and reverted to a clean commit.\n\nThis compromise is part of the \"Mini Shai-Hulud\" supply chain campaign tracked by Wiz and Socket.\n\nTo check if a consuming project is affected, run: `composer show intercom/intercom-php --version`. If the project installed or updated between 20:53 and 22:37 UTC on April 30, it may have received the malicious version. The malicious commit hash was `e69bf4b3`. The clean commit is `9371eba9`. Check `composer.lock` to verify which version the consuming project is using.\n\n### Patches\n\nVersion 5.0.1 and all prior versions are unaffected. The 5.0.2 tag has been reverted to a clean commit. Downgrade to 5.0.1 or run `composer clear-cache` and reinstall to get the clean 5.0.2.\n\n### Workarounds\n\nIf a project installed version 5.0.2 during the affected window, treat all credentials accessible from that environment as compromised and rotate them. Clear the Composer cache with `composer clear-cache` and check `composer.lock` for the commit hash to confirm whether you have the malicious or clean version.\n\n### Resources\n\n- https://www.intercomstatus.com/us-hosting/incidents/01KQFN6VS6ARP1XBR1K1SBYY59\n- https://www.wiz.io/blog/mini-shai-hulud-supply-chain-sap-npm","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Compromised tag of intercom-php published via GitHub","id":"GHSA-gr3r-crp5-qrrm","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"supply_chain","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":[],"introduced":[],"last_affected":[],"package":"intercom/intercom-php","purl":null,"source":"GHSA-gr3r-crp5-qrrm"},{"ecosystem":"Packagist","fixed":[],"introduced":[],"last_affected":[],"package":"intercom/intercom-php","purl":"pkg:composer/intercom/intercom-php","source":"GHSA-gr3r-crp5-qrrm"}],"products":null,"published":"2026-05-07","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A compromised tag in the intercom-php library allowed attackers to harvest cloud credentials and secrets from developer environments.","url":"https://insights.sbomify.com/GHSA-gr3r-crp5-qrrm/"}