Laravel-Lang Supply Chain Attack: Malicious GitHub Tags Turn Trusted PHP Packages Into Credential Thieves
Attackers hijacked four widely-downloaded Laravel-Lang packages by abusing GitHub version tagging to slip a cross-platform credential stealer past Composer's defenses.
Written by OutOfToken AI
May 30, 2026 · 4 min read · Synthesized from reporting by The Hacker News · How this works
A sophisticated software supply chain attack has compromised at least four PHP packages maintained under the Laravel-Lang organization, weaponizing them to distribute a cross-platform credential-stealing framework to an unknown number of downstream developers. Security firms StepSecurity, Aikido Security, and Socket independently flagged the campaign after detecting an anomalous burst of newly published version tags across the affected repositories. The attack exploits the implicit trust developers place in established open-source maintainers — and exposes a critical blind spot in how the PHP ecosystem handles version integrity.
The Attack Surface: Four Packages, One Compromised Org
The packages caught in the crossfire — laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions — are not obscure dependencies. Laravel-Lang is a legitimate, heavily maintained localization project that supplies language files and translation utilities to Laravel applications worldwide, with combined downloads running into the tens of millions. Attackers targeted the organization's GitHub presence, publishing malicious tags that mapped to poisoned commits. Because Composer, PHP's dominant dependency manager, resolves packages by pulling tagged releases directly from version control, any developer whose composer.json pulled a newly tagged version would have silently ingested the malicious payload.
GitHub Tags as a Delivery Mechanism
The mechanics of this attack reveal a nuanced understanding of how modern PHP dependency resolution works. Rather than compromising Packagist — the central repository that indexes Composer packages — the adversaries went upstream to GitHub itself, injecting malicious code at the source that Packagist mirrors. Researchers noted that the timing and clustering of the newly published tags across multiple repositories within the same organization pointed unmistakably to a coordinated, org-level compromise rather than individual package incidents. This technique effectively bypasses integrity checks that focus narrowly on the Packagist registry, exploiting the assumption that a tag published by a known maintainer account is safe.
""The timing and pattern of the newly published tags point to a broader compromise of the Laravel Lang org" — security researchers, underscoring that this was no isolated incident but a deliberate, multi-package operation."
A Credential Stealer Built to Cross Platforms
The payload itself is described as a comprehensive credential-stealing framework engineered to operate across multiple operating systems, suggesting the attackers anticipated a diverse victim pool spanning Linux, macOS, and Windows development environments. While full technical indicators of compromise have not been publicly catalogued at the time of writing, credential stealers of this class typically harvest browser-stored passwords, session tokens, SSH keys, environment files containing API secrets, and cloud provider credentials — precisely the kind of material that enables lateral movement into production infrastructure. For Laravel developers, whose applications frequently touch databases, payment processors, and cloud storage, the downstream blast radius of a successful credential harvest could be severe.
This attack joins a lengthening list of supply chain compromises — from the xz Utils backdoor to the PyPI typosquatting wave — that demonstrate threat actors are systematically targeting the tooling layer beneath applications rather than the applications themselves. PHP's ecosystem, long considered lower-profile than npm or PyPI in attacker calculus, is clearly no longer flying under the radar. Developers relying on any Laravel-Lang package should audit their dependency lock files, verify installed versions against known-good commit hashes, and rotate any credentials that may have been exposed in affected build environments. The broader lesson is unambiguous: trusted maintainer status is not a sufficient security boundary, and ecosystems without cryptographic release signing will keep paying this price.
Editorial Note
Laravel-Lang packages are legitimate, widely-used open-source projects with significant downloads. The Hacker News is a reputable cybersecurity news source that typically reports on verified supply chain attacks. However, the incomplete summary and lack of specific CVE or official advisory links prevents a full verification without accessing the complete original report.
Claim Tracker
AI-assessed
Specific packages named: laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, laravel-lang/actions. Independently flagged by multiple security firms (StepSecurity, Aikido Security, Socket)
Claim presented without specific numerical data or source attribution
Technical mechanism described but specific evidence or examples not provided in excerpt
Confirmed by the independent detection by three separate security firms
Industry consensus; Composer is the de facto package manager for PHP
Ask AI about this story
// discussion
sign in to join the discussion