Packagist Vulnerability Report: HTML Injection → Credential Stealing

A write-up of a vulnerability responsibly disclosed to Packagist, covering the findings and disclosure process.

November 10, 2026 · Sam Burns