MalwarePublished 23 May 2026

Laravel Lang packages hijacked to deploy credential-stealing malware

Source Bleeping Computer

local

Description

A supply chain attack targeting the Laravel Lang localization packages has exposed developers to a sophisticated credential-stealing malware campaign after attackers abused GitHub version tags to distribute malicious code through Composer packages. [...]

Impact

Developers installing affected Laravel Lang packages risked infection by a sophisticated credential-stealing malware capable of harvesting cloud credentials, Kubernetes secrets, Vault tokens, Git credentials, CI/CD secrets, SSH keys, browser data, cryptocurrency wallets, password managers, VPN configurations, and local environment files. The malware exfiltrates encrypted stolen data to an attacker-controlled server. This compromises developer environments and potentially any connected infrastructure or services relying on exposed credentials. The attack did not alter project source code but abused GitHub tag functionality, increasing the difficulty of detection.

Defensive guidance

Packagist has removed the malicious package versions and temporarily unlisted the affected Laravel Lang packages to prevent further installations. Developers should review their installed Laravel Lang package versions for signs of compromise, rotate any potentially exposed credentials, and inspect systems for indicators of compromise. Additionally, checking for historical outbound connections to the attacker's command and control server (flipboxstudio[.]info) is recommended.

Summary

Attackers compromised four Laravel Lang repositories by rewriting existing GitHub tags to point to malicious commits in forks, distributing malware through Composer packages without modifying the original source code. The malicious releases introduced a PHP helper file loaded automatically by Composer, which downloaded a second payload from a command and control server. This payload is a credential stealer targeting multiple platforms and harvesting a wide range of sensitive credentials and secrets, including cloud and developer environment data. On Windows, an embedded executable extracts browser encryption keys. The attack leveraged GitHub's tag rewriting feature to masquerade malicious commits as legitimate releases. Packagist responded by removing malicious versions and unlisting affected packages.

References

bleepingcomputer.com/news/security/laravel-lang-packages-hijacked-to-deploy-credential-stealing-malware/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 May 2026, 19:29 UTC

References

Community reviews

Related threats