Attackers compromised four Laravel Lang repositories by rewriting existing GitHub tags to point to malicious commits in forks, distributing malware through Composer packages without modifying the original source code. The malicious releases introduced a PHP helper file loaded automatically by Composer, which downloaded a second payload from a command and control server. This payload is a credential stealer targeting multiple platforms and harvesting a wide range of sensitive credentials and secrets, including cloud and developer environment data. On Windows, an embedded executable extracts browser encryption keys. The attack leveraged GitHub's tag rewriting feature to masquerade malicious commits as legitimate releases. Packagist responded by removing malicious versions and unlisting affected packages.

Developers installing affected Laravel Lang packages risked infection by a sophisticated credential-stealing malware capable of harvesting cloud credentials, Kubernetes secrets, Vault tokens, Git credentials, CI/CD secrets, SSH keys, browser data, cryptocurrency wallets, password managers, VPN configurations, and local environment files. The malware exfiltrates encrypted stolen data to an attacker-controlled server. This compromises developer environments and potentially any connected infrastructure or services relying on exposed credentials. The attack did not alter project source code but abused GitHub tag functionality, increasing the difficulty of detection.

Packagist has removed the malicious package versions and temporarily unlisted the affected Laravel Lang packages to prevent further installations. Developers should review their installed Laravel Lang package versions for signs of compromise, rotate any potentially exposed credentials, and inspect systems for indicators of compromise. Additionally, checking for historical outbound connections to the attacker's command and control server (flipboxstudio[.]info) is recommended. No official patch is applicable since the attack exploited repository tag manipulation rather than a software vulnerability.