Back Gbhackers

Packagist Themes Deliver Trojanized jQuery in OphimCMS Supply Chain Attack

Gbhackers •Mayura Kathir • March 17, 2026

A new OphimCMS supply chain attack in which six Packagist themes ship trojanized jQuery and other JavaScript to compromise site visitors rather than servers. Researchers found six malicious Composer packages under the “ophimcms” namespace on Packagist that pretend to be legitimate themes for OphimCMS, a Vietnamese-language Laravel CMS used for movie streaming sites. These packages […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OphimCMS Supply Chain Attack Delivers Trojanized jQuery via Malicious Packagist Themes A supply chain attack has compromised OphimCMS, a Vietnamese-language Laravel CMS, through six malicious Composer packages published on Packagist. These packages, disguised as legitimate themes, contain trojanized JavaScript assets, primarily fake jQuery libraries, aimed at redirecting site visitors to malicious sites. The attack specifically targets users of OphimCMS, which is commonly used for movie streaming websites. Researchers discovered the malicious packages under the 'ophimcms' namespace, indicating a targeted approach to exploit this particular CMS. The scope of the attack is significant as it affects any website utilizing these themes, potentially impacting a large number of users. Currently, there is no mention of a patch or remediation available for affected users. Security professionals are advised to monitor for any signs of compromise related to these packages. 2 sources 65

Extracted Entities

Packagist Themes Deliver Trojanized jQuery in OphimCMS Supply Chain Attack

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Platforms (1)

Tools (1)