Loading story…
Security researchers reported a PHP supply-chain compromise on Packagist in which packages published by the actor nhattuanbl embedded a remote access trojan (RAT) while masquerading as legitimate Laravel utility libraries. The RAT payload was identified in src/helper.php within nhattuanbl/lara-helper and nhattuanbl/simple-queue, while nhattuanbl/lara-swagger acted as a “clean” loader by declaring nhattuanbl/lara-helper as a hard Composer dependency, causing the malicious code to be pulled in during installation.
Once installed, the malware initiates outbound connectivity to the command-and-control endpoint helper[.]leuleu[.]net:2096, sends host profiling/reconnaissance data, and then awaits operator commands, enabling full remote control of the affected host. Reporting indicates the actor used reputation seeding by publishing additional clean packages under the same long-standing Packagist account (created in 2015) during a June–December 2024 publishing window, before releasing the RAT-bearing packages; researchers submitted takedown requests, but the packages were still available at the time of publication. Impacted Laravel/PHP applications may expose sensitive secrets available to the running process (e.g., .env environment variables, database credentials, and API keys).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
At publication, the command-and-control server was described as non-responsive, but the malware was noted to keep retrying connections indefinitely or at short intervals, meaning previously infected systems could reconnect if infrastructure returns.
After identifying the malicious packages, Socket submitted takedown requests to Packagist. At the time of reporting, the packages were still available.
Socket's Threat Research Team discovered and analyzed the malicious Packagist packages, linking the activity to the nhattuanbl publisher and documenting the embedded and transitive dependency delivery paths for the RAT.
When installed, the packages automatically execute the payload during Laravel boot or class autoload, launching a background process that profiles the host and connects to helper[.]leuleu[.]net:2096 over AES-128-CTR-encrypted TCP for remote command execution, file operations, and screenshots.
Later in that June–December 2024 publication sequence, the actor published packages including nhattuanbl/lara-helper and nhattuanbl/simple-queue with an obfuscated RAT in src/helper.php, while nhattuanbl/lara-swagger pulled the malware through a hard dependency on lara-helper.
A threat actor using the Packagist account name "nhattuanbl" published multiple PHP packages between June and December 2024, including several benign-looking libraries likely intended to build credibility with developers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecybersecuritynews.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A supply-chain attack hit the **Laravel-Lang** ecosystem after attackers rewrote Git tags across `laravel-lang/lang`, `laravel-lang/attributes`, `laravel-lang/http-statuses`, and related repositories, causing **233 tagged package versions** to resolve to malicious commits. Researchers said the attacker abused GitHub tags that pointed to forked commits rather than altering the visible upstream code, allowing poisoned releases to spread through Composer and Packagist; one report said roughly **700 GitHub repositories** were affected. Packagist removed the malicious versions and temporarily unlisted the impacted packages to stop further installs. The malicious packages added `src/helpers.php` through Composer's `autoload.files`, so code executed automatically when applications loaded `vendor/autoload.php` in common PHP workflows including Laravel, Symfony, PHPUnit, and CI runners. The payload contacted **`flipboxstudio.info`**, dropped follow-on malware, and stole secrets including cloud credentials, CI environment variables, developer tokens, SSH keys, browser passwords, cryptocurrency wallets, VPN data, and Windows-specific credentials before encrypting and exfiltrating the data and deleting artifacts to hinder forensics. Security firms urged organizations that installed affected packages after the compromise to treat those environments as breached, rotate all accessible secrets, inspect `composer.lock` files, monitor for suspicious outbound traffic, and rebuild compromised systems from known-good images.
Jun 29, 2026
Multiple `Laravel-Lang` packages were reportedly poisoned to distribute malware through the software supply chain, exposing developers and downstream environments that installed the compromised components. The incident affected a widely used localization package ecosystem for Laravel applications, turning trusted dependencies into a delivery mechanism for malicious code and raising concerns about package integrity in developer workflows. The broader reporting context underscores continued pressure on organizations from software compromise, ransomware, and data theft incidents, but the clearest common event here is the package poisoning campaign targeting Laravel developers. The case highlights the risk that attackers can abuse legitimate repositories and trusted update paths to spread malware, making dependency verification, repository monitoring, and rapid package auditing critical for defenders.
Jun 29, 2026
A malicious `intercom/intercom-php` **5.0.2** package was uploaded to Packagist after an attacker abused compromised publishing rights, turning the legitimate PHP SDK into a Composer plugin that executed malware during install or update. Reports say the package launched `setup-intercom.sh`, downloaded Bun, and ran an obfuscated `router_runtime.js` payload tied to the **Mini Shai-Hulud** campaign, which had previously been linked to a compromised Intercom npm package. Because the payload ran at dependency installation time, affected developer workstations and CI/CD pipelines could be compromised even if the library was never imported by the application. The malware was described as enabling arbitrary code execution with the privileges of the user running Composer, then harvesting environment variables and credential files from developer, cloud, Kubernetes, Vault, Docker, and application environments. Stolen data was encrypted and exfiltrated to a hardcoded endpoint with a fallback GitHub-based channel, creating risks including unauthorized AWS activity, access to private `S3` buckets, `Route53` manipulation, and database theft or destruction. Researchers said the campaign also sought downstream software supply-chain propagation by seeding additional malicious packages, while Packagist removed the artifact after disclosure and defenders were urged to audit installs, inspect repositories and build logs, and rotate exposed credentials.
Jun 29, 2026