> All PHP/PEAR users who have downloaded the installation file go-pear.phar from the official website in the past six months should consider themselves compromised and quickly download and install the Github version.



> past six months



Целых 6 месяцев происходила "дичь", но никто ничего не замечал.



Someone Hacked PHP PEAR Site and Replaced the Official Package Manager

https://thehackernews.com/2019/01/php-pear-hacked.html