Reported by 1 outlet

Timeline

1. original reporting

   Laravel-Lang Supply Chain Attack Compromises 700+ Package Versions — RCE Backdoor and 17-Module Credential Stealer

   gbhackers.com · 144d ago · May 23rd, 2026

   Attackers compromised the Laravel-Lang open-source organization, weaponizing four popular PHP localization packages (laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, laravel-lang/actions) by creating release tags pointing to commits in malicious forks — no code was ever committed to official repos. The malicious src/helpers.php file registered under Composer's autoload.files executes automatically on every PHP request, contacting C2 flipboxstudio[.]info with TLS verification disabled. The second-stage payload is a ~5,900-line PHP credential stealer with 17 specialist modules targeting: Kubernetes Service Account tokens, HashiCorp Vault (recursive API query), Docker credentials, Jenkins master.key, GitHub Actions secrets, SSH keys, 17 Chromium-based browsers (with a custom DebugChromium.exe to bypass Chrome App-Bound Encryption), Firefox NSS, 6 password managers (1Password, Bitwarden, LastPass, KeePass, Dashlane, NordPass), cryptocurrency wallets, and Slack/Discord session tokens. Exfiltration uses XOR key k9X2mP7vL4nQ8wR1 to flipboxstudio[.]info/exfil, then self-deletes. Packagist has unlisted the packages.