Thirteen malicious Packagist themes inject redirects and an iOS exploit chain that can steal device data and cryptocurrency wallet secrets.