Skip to content

Back to the catalog

Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets
stepsecurity.iowriteup

Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets

StepSecurity documents a supply-chain attack where a single actor compromised four Laravel-Lang Composer packages (laravel-lang/lang, http-statuses, actions, attributes) by rewriting every existing git tag to point at malicious commits that add src/helpers.php to Composer's eager autoload.files map. On any composer install/update or app boot, the payload fetches a stage-2 loader and an ELF binary from the C2 domain flipboxstudio.info, exfiltrates CI/runner secrets, then self-deletes and reparents to init to evade forensics. The team confirmed end-to-end exploitation by detonating laravel-lang/http-statuses v3.4.5 inside a Harden-Runner-monitored GitHub Actions runner, capturing the full process tree, network calls, and providing recovery/IOC guidance for affected users and maintainers.

TL;DR Attacker rewrote all git tags across four laravel-lang Composer packages to inject an autoload-triggered payload that steals CI secrets via C2 domain flipboxstudio.info.
Open original ↗
Document

What it is

A supply chain compromise of four Laravel-Lang Composer packages — laravel-lang/lang (502 tags), http-statuses, actions (46 tags), attributes (86 tags) — carried out on 2026-05-22 between 22:32 and 00:00 UTC. One actor with org-wide push access rewrote every existing git tag to point at a malicious commit, so there is no clean version to pin to and no new version number that signals the change.

How it works

Each poisoned commit modifies only two files, composer.json and src/helpers.php, and adds src/helpers.php to Composer's autoload.files map. Unlike psr-4/classmap (lazy), files is eager: the file is required the instant vendor/autoload.php loads — which every Laravel, Symfony, and PHPUnit boot does. No class instantiation or trigger is needed. helpers.php fetches stage 2 from https://flipboxstudio.info/payload, writes it under the system cache dir with a bin2hex(random_bytes(6)) filename, and backgrounds it via php "$f" > /dev/null 2>&1 & (Windows uses WScript.Shell). It drops a PHP loader and ELF binary in /tmp, exfiltrates runner env data via POST .../exfil, then self-deletes.

Preconditions / Affected

Projects that pin a version range (^3.4, ~2.0, *) and run composer update will resolve to a poisoned tag. Projects whose composer.lock already pins a pre-2026-05-22 commit SHA are safe only if they run composer install against that lockfile and the locked SHA is not one of the imposter commits.

What to do

  • Do not composer update these packages. Run composer install against a known-good lockfile only.
  • The only safe pin is a pre-2026-05-22 commit SHA independently verified against a local clone or the Packagist mirror — not a tag or version constraint.
  • Verify locked SHAs are not imposter commits. Reference clean/poisoned SHAs the page lists include http-statuses v3.4.5 → bba2e443..., v1.0.0 → 6b1d5782...; lang 15.29.5 → a5ea2e8f... (all listed SHAs in the page are the malicious rewrites — treat them as blocklist).
  • Hunt IOCs: git commits authored by Your Name <you@example.com> touching only composer.json + src/helpers.php; network to flipboxstudio.info; /tmp/.laravel_locale/<12 hex>.php, /tmp/.<8 hex> ELF; orphaned php and unnamed ELF processes with ppid=1 running from deleted /tmp paths.

Caveats

Only http-statuses v3.4.5 was detonated end-to-end (Harden-Runner, audit mode); the other three are inferred to behave identically from shared commit structure but were not executed. Filesystem artifacts self-delete within seconds, so they are visible mainly on a live runner or snapshot; the process indicators persist because the binary runs from memory after its on-disk path is unlinked.

Organisations named here

  • flipboxstudio.info

Technologies named here

  • laravel-lang/lang
  • StepSecurity Harden-Runner
  • laravel-lang/http-statuses
  • Composer
  • laravel-lang/actions
  • Packagist
  • laravel-lang/attributes
  • Laravel applications
  • Symfony applications
  • PHPUnit
  • PHP
  • Laravel
  • GitHub Actions
  • StepSecurity
  • Laravel-Lang
  • Harden-Runner

Techniques named here

  • Git tag rewriting for supply chain compromise
  • Composer autoload.files eager execution abuse
  • Staged payload download and execution
  • Process reparenting to init for persistence/evasion
  • Self-deleting dropper artifacts
  • CI/CD secret exfiltration
  • Typosquatted C2 domain

Threat actors named here

  • Unnamed single threat actor

Related in Supply Chain