Pear

 Pear  is a package manager for PHP that was compromised for 6 months with a malicious version that was downloaded and deployed to an unknown number of websites. https://thehackernews.com/2019/01/php-pear-hacked.html.