Back Cybersecuritynews

6 Malicious Packagist Themes Ship Trojanized jQuery in OphimCMS Supply Chain Attack

Cybersecuritynews •Tushar Subhra Dutta • March 17, 2026

A new supply chain attack has targeted OphimCMS, a Vietnamese-language Laravel content management system widely used for building movie streaming websites. Six malicious Composer packages were published on Packagist under the ophimcms namespace, carefully disguised as legitimate themes for the platform. Each package carries trojanized JavaScript assets — primarily fake jQuery libraries — designed to redirect visitors, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OphimCMS Supply Chain Attack Delivers Trojanized jQuery via Malicious Packagist Themes A supply chain attack has compromised OphimCMS, a Vietnamese-language Laravel CMS, through six malicious Composer packages published on Packagist. These packages, disguised as legitimate themes, contain trojanized JavaScript assets, primarily fake jQuery libraries, aimed at redirecting site visitors to malicious sites. The attack specifically targets users of OphimCMS, which is commonly used for movie streaming websites. Researchers discovered the malicious packages under the 'ophimcms' namespace, indicating a targeted approach to exploit this particular CMS. The scope of the attack is significant as it affects any website utilizing these themes, potentially impacting a large number of users. Currently, there is no mention of a patch or remediation available for affected users. Security professionals are advised to monitor for any signs of compromise related to these packages. 2 sources 65

Extracted Entities

6 Malicious Packagist Themes Ship Trojanized jQuery in OphimCMS Supply Chain Attack

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (2)

Platforms (3)

Tools (1)