Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer

What it is

An active supply chain attack (detected May 22, 2026) against three Composer packages: laravel-lang/lang (7.8k stars), laravel-lang/attributes, and laravel-lang/http-statuses. 233 versions were compromised. The malicious code loads automatically via Composer's autoloader, so simply installing an affected version executes it — no application code needs to call it.

How it works

The attacker never pushed malicious commits to the official repos. GitHub lets a version tag point at a commit from a fork of the same repository; the attacker created a controlled fork and pointed the version tags there. So the repo's own history and default branch look clean — you have to inspect what each tag actually resolves to.

The injected src/helpers.php defines two innocuous-looking functions (laravel_lang_locale(), laravel_lang_fallback()), then runs a self-executing block that fingerprints the host and writes a marker file so it fires once. The C2 domain is stored as a runtime-decoded integer array (defeats static string scanning), resolving to flipboxstudio[.]info. The dropper fetches the ~5,900-line stealer from /payload (SSL verification disabled), runs it via a .vbs/cscript launcher on Windows or backgrounded exec() on Linux/macOS, then the stealer AES-256-encrypts its haul, POSTs to /exfil, and self-deletes.

Preconditions / Affected

Any environment that installed one of the 233 compromised versions of the three packages above. On Windows the payload additionally drops a bundled .exe to decrypt Chrome's DPAPI login database and actively decrypts WinSCP passwords, so Windows dev hosts lose more.

What to do

Packagist has removed the malicious versions and temporarily unlisted the packages, but installed environments are already infected — removal upstream does not clean your machine. Treat any host that ran an affected version as fully compromised and rotate everything the stealer targets (cloud keys, SSH/git creds, .env secrets, browser/password-manager vaults, crypto wallets, VPN configs).

Hunt for these indicators:

Network (C2):

flipboxstudio.info
flipboxstudio.info/payload
flipboxstudio.info/exfil

Files/paths (in system temp dir):

<tmp>/.laravel_locale/<md5_hash>            # infection marker
<tmp>/.laravel_locale/<12 hex chars>.php    # dropped stealer
<tmp>/.laravel_locale/<8 hex chars>.vbs     # Windows launcher

Because the stealer self-deletes, absence of the .php/.vbs files does not clear a host — the marker file and any egress to flipboxstudio[.]info are the more durable signals.

Caveats

The affected-package list is given but the specific compromised version numbers are not enumerated on the page (only the count, 233), so assume any recently pinned version is suspect and verify what each installed tag resolves to on GitHub rather than trusting the count.