laravel-lang Packagist packages re-tagged from a compromised org credential

Late on May 22, 2026, an attacker with push access to the Laravel-Lang GitHub organization rewrote every version tag on four widely used Laravel translation packages, planting a credential stealer that ran on the next composer update for downstream applications.

Laravel-Lang publishes Laravel translation packages on Packagist, the central Composer package index. Four repositories under the organization back four Composer packages: lang, attributes, actions, and http-statuses. Between 22:32 and 23:24 UTC on May 22, researchers at StepSecurity said the attacker rewrote every tag across all four, 502 on the lang repository alone and smaller numbers in proportion to the others. Each malicious commit was authored as Your Name <you@example.com> and changed two files, composer.json and a new src/helpers.php. Identical diffs and the same fake author string across all four repositories pointed StepSecurity to a single compromised organization-wide push credential. An earlier Aikido report had described the delivery as a fork-tag pattern; StepSecurity's git evidence ruled that out. A malware researcher at Aikido filed the compromise directly with the maintainers, urging them to rotate credentials and delete the new tags.

The composer.json change appended src/helpers.php to the autoload.files array. Composer includes every file on that list whenever an application loads vendor/autoload.php, the standard Laravel boot path, so no individual call site needed to import the helper. Any composer update, or any composer install without a pre-attack lockfile, resolved each version constraint to the new tag SHA and executed the helper on the next request, and on every request the application served afterward. Pre-attack lockfiles were safe until they were refreshed. The dropper assembled its C2 hostname at runtime from character codes to avoid plain-text strings, fetched a second stage from flipboxstudio.info, a typosquat of the legitimate flipboxstudio.com, over TLS with certificate verification disabled and a spoofed Mozilla User-Agent, wrote it under sys_get_temp_dir()/.laravel_locale/, executed it in a detached process, and unlinked itself from disk. A per-host MD5 marker kept the stealer from running twice on the same machine. On Windows it dropped a .vbs file and ran it through cscript, and StepSecurity observed a Linux variant that executed an ELF from /tmp/.<8 hex> and removed the path so the process kept running from a deleted inode under parent PID 1.

Socket's reverse engineering of stage two describes a credential-harvesting framework with seventeen collectors, reaching cloud instance metadata, Kubernetes service-account and HashiCorp Vault tokens, working directories for Jenkins, GitLab Runner, GitHub Actions, CircleCI, TravisCI, and ArgoCD, SSH keys, Git and Docker credentials, per-process environments, browser profiles, password manager stores, and cryptocurrency wallets. On Windows the payload shipped an embedded DebugChromium.exe that abused Chrome's own debugging interface to extract the v127+ app-bound encryption key and decrypt saved passwords that Chrome's newer protections would otherwise have kept out of reach. Packagist removed the malicious versions and temporarily delisted the four packages, and StepSecurity advised operators to halt composer update until lockfiles were verified against pre-attack SHAs and to rotate any CI token, cloud credential, or deploy key a runner could reach during the window. The tag-rewrite delivery resembles the actions-cool compromise four days earlier (see [[actions-cool]]), but the two are distinct. There, TeamPCP routed tags on official refs to commits inside an attacker-owned fork without ever pushing to the official repository; here the attacker held push access and rewrote tags directly. The flipboxstudio.info infrastructure does not appear in the Mini Shai-Hulud campaign.