Laravel-Lang Packages Poisoned for Malware Delivery
Source SecurityWeek
Description
Published within a 15-minute window, the malicious tags introduced backdoors to exfiltrate CI secrets. The post Laravel-Lang Packages Poisoned for Malware Delivery appeared first on SecurityWeek .
Impact
The attack potentially exposed a wide range of sensitive credentials and secrets across affected systems, including cloud infrastructure keys, container orchestration tokens, developer and CI/CD credentials, browser and password manager data, and cryptocurrency wallets. This exposure could lead to unauthorized access to cloud environments, source code repositories, developer machines, and other critical infrastructure components. The poisoning of over 700 historical package versions means that any application fetching or updating these packages during or after the attack window could be compromised. The stealthy nature of the attack, with no malicious commits in official repos, increases the risk of undetected compromise.
Defensive guidance
Organizations should immediately block and avoid using the affected Laravel-Lang packages (laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, laravel-lang/actions) until clean versions are confirmed. Systems that installed or updated these packages during the attack window should be treated as potentially compromised. It is critical to rotate all secrets and credentials accessible to affected hosts, containers, CI runners, and developer machines, including cloud keys, Kubernetes tokens, Vault tokens, SSH keys, and any other exposed credentials. Monitoring for unusual activity related to these credentials is advised. Confirm availability of clean package versions from trusted sources before reinstalling. Follow vendor advisories and security community updates for further remediation guidance.
Summary
On May 22-23, 2026, attackers compromised the Laravel-Lang organization's release process by publishing malicious Git tags across four Composer packages (laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions). These tags pointed to commits in a malicious fork, injecting a PHP backdoor named src/helpers.php that fingerprinted infected machines and connected to a command-and-control server to download a credential stealer. The malware targeted a broad range of sensitive credentials including cloud provider keys (AWS, GCP, Azure), Docker and Kubernetes tokens, HashiCorp Vault tokens, Helm configurations, SSH keys, developer credentials, browser and password manager data, cryptocurrency wallets, VPN configs, and local application secrets. Over 700 historical versions were affected, indicating a widespread supply chain compromise rather than a single malicious release. The attack bypassed traditional repository code review by exploiting Git tag functionality, making detection and mitigation more challenging.