Loading story…
A supply-chain attack hit the Laravel-Lang ecosystem after attackers rewrote Git tags across laravel-lang/lang, laravel-lang/attributes, laravel-lang/http-statuses, and related repositories, causing 233 tagged package versions to resolve to malicious commits. Researchers said the attacker abused GitHub tags that pointed to forked commits rather than altering the visible upstream code, allowing poisoned releases to spread through Composer and Packagist; one report said roughly 700 GitHub repositories were affected. Packagist removed the malicious versions and temporarily unlisted the impacted packages to stop further installs.
The malicious packages added src/helpers.php through Composer's autoload.files, so code executed automatically when applications loaded vendor/autoload.php in common PHP workflows including Laravel, Symfony, PHPUnit, and CI runners. The payload contacted flipboxstudio.info, dropped follow-on malware, and stole secrets including cloud credentials, CI environment variables, developer tokens, SSH keys, browser passwords, cryptocurrency wallets, VPN data, and Windows-specific credentials before encrypting and exfiltrating the data and deleting artifacts to hinder forensics. Security firms urged organizations that installed affected packages after the compromise to treat those environments as breached, rotate all accessible secrets, inspect composer.lock files, monitor for suspicious outbound traffic, and rebuild compromised systems from known-good images.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-23, multiple security researchers and outlets publicly reported the supply chain attack, describing how attackers poisoned Laravel-Lang package versions across hundreds of GitHub-tagged releases. The disclosures warned defenders to inspect composer.lock files, treat systems installing affected packages after the compromise window as potentially compromised, and rotate exposed secrets.
After the malicious Laravel-Lang versions were identified, Packagist removed the poisoned releases and temporarily unlisted the affected packages to stop further installations. This response was reported by Aikido in coverage published on 2026-05-23.
On 2026-05-22, StepSecurity reproduced the compromise in an isolated GitHub Actions runner for laravel-lang/http-statuses v3.4.5 and observed exfiltration of runner environment data along with cleanup behavior that deleted on-disk artifacts while leaving orphaned processes in memory. The company assessed the other affected packages as likely behaving the same because of their matching malicious commit structure.
The poisoned package versions added a backdoored src/helpers.php via Composer autoload.files so code executed automatically when the packages were installed or autoloaded. The malware contacted flipboxstudio.info, deployed a dropper and second-stage stealer, collected secrets such as cloud credentials, developer tokens, SSH keys, browser passwords, wallet data, and other infrastructure secrets, then encrypted and exfiltrated the data.
On 2026-05-22, a threat actor compromised Laravel-Lang Composer packages by force-rewriting existing Git tags to point to malicious commits, abusing GitHub tags rather than committing directly to the official upstream repositories. Reports indicate the affected repositories included laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/lang/actions-related packages, with 233 tagged versions impacted across the ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcexakep.ru
Open sourcephoenix.security
Open sourcethreats.wiz.io
Open sourcebleepingcomputer.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcestepsecurity.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple `Laravel-Lang` packages were reportedly poisoned to distribute malware through the software supply chain, exposing developers and downstream environments that installed the compromised components. The incident affected a widely used localization package ecosystem for Laravel applications, turning trusted dependencies into a delivery mechanism for malicious code and raising concerns about package integrity in developer workflows. The broader reporting context underscores continued pressure on organizations from software compromise, ransomware, and data theft incidents, but the clearest common event here is the package poisoning campaign targeting Laravel developers. The case highlights the risk that attackers can abuse legitimate repositories and trusted update paths to spread malware, making dependency verification, repository monitoring, and rapid package auditing critical for defenders.
Jun 29, 2026
Security researchers reported a **PHP supply-chain compromise** on *Packagist* in which packages published by the actor **nhattuanbl** embedded a remote access trojan (RAT) while masquerading as legitimate Laravel utility libraries. The RAT payload was identified in `src/helper.php` within `nhattuanbl/lara-helper` and `nhattuanbl/simple-queue`, while `nhattuanbl/lara-swagger` acted as a “clean” loader by declaring `nhattuanbl/lara-helper` as a hard *Composer* dependency, causing the malicious code to be pulled in during installation. Once installed, the malware initiates outbound connectivity to the command-and-control endpoint `helper[.]leuleu[.]net:2096`, sends host profiling/reconnaissance data, and then awaits operator commands, enabling full remote control of the affected host. Reporting indicates the actor used **reputation seeding** by publishing additional clean packages under the same long-standing Packagist account (created in 2015) during a June–December 2024 publishing window, before releasing the RAT-bearing packages; researchers submitted takedown requests, but the packages were still available at the time of publication. Impacted Laravel/PHP applications may expose sensitive secrets available to the running process (e.g., `.env` environment variables, database credentials, and API keys).
Jun 29, 2026
A malicious `intercom/intercom-php` **5.0.2** package was uploaded to Packagist after an attacker abused compromised publishing rights, turning the legitimate PHP SDK into a Composer plugin that executed malware during install or update. Reports say the package launched `setup-intercom.sh`, downloaded Bun, and ran an obfuscated `router_runtime.js` payload tied to the **Mini Shai-Hulud** campaign, which had previously been linked to a compromised Intercom npm package. Because the payload ran at dependency installation time, affected developer workstations and CI/CD pipelines could be compromised even if the library was never imported by the application. The malware was described as enabling arbitrary code execution with the privileges of the user running Composer, then harvesting environment variables and credential files from developer, cloud, Kubernetes, Vault, Docker, and application environments. Stolen data was encrypted and exfiltrated to a hardcoded endpoint with a fallback GitHub-based channel, creating risks including unauthorized AWS activity, access to private `S3` buckets, `Route53` manipulation, and database theft or destruction. Researchers said the campaign also sought downstream software supply-chain propagation by seeding additional malicious packages, while Packagist removed the artifact after disclosure and defenders were urged to audit installs, inspect repositories and build logs, and rotate exposed credentials.
Jun 29, 2026