The Laravel Lang package hijack is another serious reminder that open-source supply-chain attacks are increasingly targeting developer trust, not just production applications. In this case, attackers abused GitHub version tags across Laravel Lang repositories so that Composer installations appeared to pull legitimate releases while actually downloading malicious code from attacker-controlled commits. The affected packages included laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and possibly laravel-lang/actions.
What makes this attack especially concerning is that the project’s normal source code was reportedly not modified in the obvious way. Instead, existing Git tags were rewritten to point to malicious commits, which allowed compromised releases to look legitimate to developers and automation tools. That is supply-chain abuse at its most irritatingly clever: no dramatic fake package name, just trust quietly redirected while everyone’s build system nods along.
The malicious package added a Composer-autoloaded helpers.php file that acted as a dropper, downloading a second-stage PHP payload from flipboxstudio[.]info. The payload targeted Linux, macOS, and Windows systems and was designed to steal cloud credentials, Kubernetes secrets, Vault tokens, Git credentials, CI/CD secrets, SSH keys, browser data, crypto wallets, password-manager data, VPN configurations, .env files, API keys, database credentials, JWTs, and more.
Developers and organizations using Laravel Lang packages should immediately review installed versions, inspect Composer lock files and build logs, check for outbound connections to the reported C2 domain, and rotate any secrets that may have been exposed. This should include GitHub tokens, cloud keys, SSH keys, CI/CD variables, database credentials, .env secrets, package registry tokens, and credentials stored in browsers or developer tools.
The larger lesson is simple: package integrity cannot rely only on familiar names and version numbers. Teams need dependency pinning, signed releases where available, tag-change monitoring, CI/CD secret isolation, outbound traffic controls, and fast secret-rotation workflows. In 2026, a localization package can become a credential-stealing delivery vehicle, because apparently even language files now need a background check.

A supply chain attack targeting the Laravel Lang localization packages has exposed developers to a sophisticated credential-stealing malware campaign after attackers abused GitHub version tags to distribute malicious code through Composer packages. [...]

Source: Laravel Lang packages hijacked to deploy credential-stealing malware via Bleeping Computer — published 23 May 2026.