Source: google-open-source-security (0bd33abd6fda35e856f8346fda5e85913ce2cad6b4d6c315a2e7138b867760aa)

This package is malicious and was compromised as part of the Mini Shai-Hulud campaign by the TeamPCP threat actor.
The malicious payload steals credentials, and can propogate to NPM packages using credentials it finds.

Credit: OpenSSF (source)

References

• GHSA-gr3r-crp5-qrrm
• https://github.com/ossf/malicious-packages/blob/c682899011b969f7ad656417289b14e5c06f2c2a/osv/malicious/packagist/intercom/intercom-php/MAL-2026-3637.json
• https://semgrep.dev/blog/2026/malicious-intercom-php-package-spreads-mini-shai-hulud-attack-to-packagist-via-composer-plugin
• https://socket.dev/blog/mini-shai-hulud-packagist-malicious-intercom-php-package-compromise