A supply chain attack disclosed on May 22 has compromised four widely used Laravel-Lang PHP packages — laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes and laravel-lang/actions — with attackers rewriting more than 700 historical version tags to point at malicious commits in a fork they controlled. The malicious code was never merged into the official repositories, but Composer resolves tags by name, so anyone reinstalling a pinned version received the backdoor.
The payload is a roughly 5,900-line PHP credential stealer split into fifteen collector modules. It harvests AWS access keys, GCP application default credentials, Azure access tokens, DigitalOcean, Heroku, Vercel, Netlify, Railway and Fly.io auth tokens, MetaMask, Electrum and Phantom wallets, browser data and every .env file it can find. The results are AES-256 encrypted and exfiltrated to flipboxstudio[.]info/exfil before the script deletes itself from disk to limit forensic evidence.
Researchers from Socket, Aikido and SecurityOnline confirmed the abuse exploited a GitHub behaviour that lets repository tags point at commits in a fork of the same repo. Maintainers have since invalidated the malicious tags, but any CI pipeline that ran a composer install during the window should treat its cloud credentials and session tokens as fully compromised and rotate them immediately.