Loading story…
Multiple Laravel-Lang packages were reportedly poisoned to distribute malware through the software supply chain, exposing developers and downstream environments that installed the compromised components. The incident affected a widely used localization package ecosystem for Laravel applications, turning trusted dependencies into a delivery mechanism for malicious code and raising concerns about package integrity in developer workflows.
The broader reporting context underscores continued pressure on organizations from software compromise, ransomware, and data theft incidents, but the clearest common event here is the package poisoning campaign targeting Laravel developers. The case highlights the risk that attackers can abuse legitimate repositories and trusted update paths to spread malware, making dependency verification, repository monitoring, and rapid package auditing critical for defenders.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
SecurityWeek reported that a data breach at Radiology Associates of Richmond affected 266,000 individuals. This introduces a new victim disclosure and impact figure not previously captured in the timeline.
SecurityWeek reported that Laravel-Lang packages had been poisoned to deliver malware, indicating a software supply chain compromise affecting those packages. The reference points to public disclosure of the malicious package activity.
A SecurityWeek reference indicates GitHub confirmed a hack affecting 3,800 internal repositories. Because the provided content contains no substantive incident details beyond the headline, only the broad confirmation can be captured.
Acuity addressed claims about stolen US government data, stating that hackers obtained older, non-sensitive information. The statement represents the company's public response and characterization of the impact.
Xerox confirmed that a US subsidiary suffered a data breach following a ransomware attack. This marks the company's official acknowledgment of compromise and resulting data exposure.
SecurityWeek reported that food giant Kraft Heinz had been targeted by a ransomware group. The reference establishes the company as a victim of a ransomware-related incident.
Fidelis Security published an overview of Apache ActiveMQ vulnerability CVE-2023-46604, marking public technical discussion of the flaw and its security implications. The reference indicates disclosure and analysis of the vulnerability rather than a specific victim incident.
Dragos disclosed that a ransomware group had obtained limited data from the company but that an elaborate extortion attempt did not succeed. The report indicates the incident did not result in the broader impact the attackers sought.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcesecurityweek.com
Open sourcesecurityweek.com
Open sourcesecurityweek.com
Open sourcesecurityweek.com
Open sourcesecurityweek.com
Open sourcesecurityweek.com
Open sourcefidelissecurity.com
Open sourcesecurityweek.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A supply-chain attack hit the **Laravel-Lang** ecosystem after attackers rewrote Git tags across `laravel-lang/lang`, `laravel-lang/attributes`, `laravel-lang/http-statuses`, and related repositories, causing **233 tagged package versions** to resolve to malicious commits. Researchers said the attacker abused GitHub tags that pointed to forked commits rather than altering the visible upstream code, allowing poisoned releases to spread through Composer and Packagist; one report said roughly **700 GitHub repositories** were affected. Packagist removed the malicious versions and temporarily unlisted the impacted packages to stop further installs. The malicious packages added `src/helpers.php` through Composer's `autoload.files`, so code executed automatically when applications loaded `vendor/autoload.php` in common PHP workflows including Laravel, Symfony, PHPUnit, and CI runners. The payload contacted **`flipboxstudio.info`**, dropped follow-on malware, and stole secrets including cloud credentials, CI environment variables, developer tokens, SSH keys, browser passwords, cryptocurrency wallets, VPN data, and Windows-specific credentials before encrypting and exfiltrating the data and deleting artifacts to hinder forensics. Security firms urged organizations that installed affected packages after the compromise to treat those environments as breached, rotate all accessible secrets, inspect `composer.lock` files, monitor for suspicious outbound traffic, and rebuild compromised systems from known-good images.
Jun 29, 2026
Security researchers reported a **PHP supply-chain compromise** on *Packagist* in which packages published by the actor **nhattuanbl** embedded a remote access trojan (RAT) while masquerading as legitimate Laravel utility libraries. The RAT payload was identified in `src/helper.php` within `nhattuanbl/lara-helper` and `nhattuanbl/simple-queue`, while `nhattuanbl/lara-swagger` acted as a “clean” loader by declaring `nhattuanbl/lara-helper` as a hard *Composer* dependency, causing the malicious code to be pulled in during installation. Once installed, the malware initiates outbound connectivity to the command-and-control endpoint `helper[.]leuleu[.]net:2096`, sends host profiling/reconnaissance data, and then awaits operator commands, enabling full remote control of the affected host. Reporting indicates the actor used **reputation seeding** by publishing additional clean packages under the same long-standing Packagist account (created in 2015) during a June–December 2024 publishing window, before releasing the RAT-bearing packages; researchers submitted takedown requests, but the packages were still available at the time of publication. Impacted Laravel/PHP applications may expose sensitive secrets available to the running process (e.g., `.env` environment variables, database credentials, and API keys).
Jun 29, 2026
Security researchers reported multiple **software supply chain** threats targeting developers via public package ecosystems. Tenable analyzed a malicious npm package, **`ambar-src`**, that reached roughly **50,000 downloads** in days before removal; it executed during installation via **malicious `preinstall` behavior**, used evasion techniques, and dropped OS-specific payloads for Windows, Linux, and macOS, with typosquatting assessed as the likely lure (mimicking *`ember-source`*). Separate reporting described a campaign using **malicious NuGet packages** (e.g., **NCryptYo**, **DOMOAuth2_**, **IRAOAuth2.0**, **SimpleWriter_**) that impersonated legitimate .NET libraries, executed code on assembly load, and established local proxying/backdoor behavior to facilitate credential theft and persistence in ASP.NET environments. Additional coverage warned of an npm “worm-like” propagation pattern impacting **CI pipelines and AI coding tools**, reinforcing that developer tooling and build systems are high-risk choke points where a single poisoned dependency can spread quickly across environments. While the broader set of articles also included unrelated breach, ransomware, and policy items, the developer-focused supply chain reporting consistently emphasized that **installation-time execution** and **typosquatting/impersonation** enable compromise even when developers never directly call the malicious code, and that traditional detection can lag (e.g., low initial antivirus detection rates for obfuscated .NET payloads).
Jun 29, 2026