Laravel Packages Compromised in Yet Another GitHub Attack

mttaggart · May 23, 2026, 5:56am

Last Updated: 2026-05-23T11:56:00Z

What’s Happening

Laravel, a popular PHP framework, has had its GitHub packages compromised by a credential stealer.

Aikido has a report, and has reported the issue to the maintainers.

github.com/Laravel-Lang/common

[MALWARE]: Compromised version tags

opened 11:04PM - 22 May 26 UTC

IlyasMakari

bug common

### Lang Package Name laravel-lang/lang ### Lang Package Version All versions… published starting May 22 ### Laravel Framework Version N/A ### PHP Version N/A ### Dependencies _No response_ ### Issue description I'm a malware researcher at Aikido Security and wanted to flag an active supply chain attack affecting multiple Laravel-Lang repositories, including `lang`, `http-statuses`, and `attributes`. **What we found:** - 100+ compromised version tags identified so far - The attacker appears to be publishing new version tags pointing to malicious commits - A `src/helpers.php` file was introduced that downloads and executes a malicious payload We recommend rotating all compromised credentials and deleting recent tags across affected repositories. ### Steps to reproduce N/A

So has Step Security.

github.com/Laravel-Lang/lang

Security: All repository tags have been rewritten to point to malicious commits

opened 01:06AM - 23 May 26 UTC

varunsh-coder

## Summary All tags in this repository have been rewritten to point to maliciou…s commits. Anyone running `composer require laravel-lang/lang` or `composer update` against any version constraint will pull a payload that exfiltrates CI/CD secrets to an attacker-controlled domain. This is part of a coordinated campaign that also affected `Laravel-Lang/http-statuses`, `Laravel-Lang/actions`, and `Laravel-Lang/attributes` on 2026-05-22. Based on timestamps, this repository (`Laravel-Lang/lang`) appears to be the first and largest target, with all 502 tags rewritten between 22:32 UTC and 23:24 UTC. ## Quick indicators - **C2 domain:** `flipboxstudio.info` - **Compromised commits author:** `Your Name <you@example.com>` - **Files modified in every malicious commit:** `composer.json` and `src/helpers.php` - **Rewrite window for this repo:** 2026-05-22 between 22:32 UTC and 23:24 UTC ## Full details For the complete analysis (kill chain, full IOC list, recovery steps for users and maintainers, evidence from a detonation in an instrumented runner), see the StepSecurity write-up which we will keep updated as we learn more: [https://www.stepsecurity.io/blog/laravel-lang-supply-chain-attack](https://www.stepsecurity.io/blog/laravel-lang-supply-chain-attack) --- — StepSecurity Threat Intelligence team

Actions

Review traffic for DNS/URL indicators of compromise
Review endpoint activity for malicious file writes
Got Laravel dependencies? Rotate those secrets
Follow Recovery steps recommended by Step

Indicators of Compromise

Value	Type	Description
`flipboxstudio[.]info`	domain	C2 domain (typosquat of flipboxstudio.com)
`hxxps://flipboxstudio[.]info/payload`	url	Stage 1 payload download URL
`hxxps://flipboxstudio[.]info/exfil`	url	Stage 2 exfiltration endpoint
`/tmp/.laravel_locale/<12 hex chars>.php`	filename	Hidden PHP loader (self-deleting)
`/tmp/.<8 hex chars>`	filename	ELF binary dropper (self-deleting, no extension)
`a5ea2e8fa92ccf29cdb1d2dadbeb27722b2bff37`	sha1	laravel-lang/lang v15.29.5 malicious commit
`bba2e443dc7ff1f8704f52a5375383e3f4f643b8`	sha1	laravel-lang/http-statuses v3.4.5 malicious commit
`556d2b335d4d6d92139822017ee461b668afe375`	sha1	laravel-lang/actions v1.12.2 malicious commit
`d59561727927117e65b35f0183cae131baad19fe`	sha1	laravel-lang/attributes v2.4.1 malicious commit
php (ppid=1, orphaned)	other	Orphaned PHP process from dropper
ELF binary from /tmp (ppid=1, unnamed)	other	Orphaned ELF process from stage 2

Notes

Socket’s report clarifies that these packages are not strictly part of the Laravel framework.

The affected packages are not part of the official Laravel framework. They are third-party localization packages used by Laravel applications. However, applications that installed compromised versions may have executed the backdoor automatically when Composer’s autoloader ran.

brettwh · May 23, 2026, 5:17pm

Overwriting all the tags is a clever way to beat version pinning. Is that a common tactic in these types of attacks?