Back Ground.News

Laravel Lang Packages Hijacked to Deploy Credential-Stealing Malware

Ground.News • May 23, 2026

A supply chain attack targeting the Laravel Lang localization packages has exposed developers to a sophisticated credential-stealing malware campaign after attackers abused GitHub version tags to distribute malicious code through Composer packages.

Attackers rewrote tags in four Laravel-Lang Composer packages to inject a PHP credential stealer. Learn what happened and how to remediate.

Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework. The affected packages include laravel-lang/lang laravel-lang/http-statuses laravel-lang/attributes laravel-lang/actions "The timing and pattern of the newly published tags

The open-source project Laravel Lang (a community-localized project) was attacked; hackers released over 700 malicious versions.

A highly sophisticated supply chain attack has compromised the Laravel-Lang ecosystem, injecting credential-stealing remote code execution backdoors into 233 package versions across 700 GitHub repositories. Discovered in May 2026 by Socket and Aikido, threat actors manipulated GitHub tags to distribute malware through Composer’s autoloader, granting complete remote access to developer environments. The attackers bypassed direct repository commit…

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Supply Chain Attack Compromises Laravel Lang Packages with Credential Stealer On May 22, 2026, a supply chain attack targeted Laravel Lang localization packages, compromising 233 versions across four repositories. Attackers exploited GitHub's version tagging system to redirect legitimate tags to malicious commits in a controlled fork. This allowed the injection of a credential-stealing malware via Composer's autoloader. The malware, which is capable of harvesting various sensitive data including cloud credentials and SSH keys, was delivered through a file named 'src/helpers.php'. Security firms Aikido and Socket confirmed the attack and reported it to GitHub and Packagist, leading to the removal of the malicious versions. The attack affects developers using the Laravel ecosystem, posing a significant risk to their environments. Current remediation efforts are in place to prevent further installations of the compromised packages. 12 sources 71

Extracted Entities

Laravel Lang Packages Hijacked to Deploy Credential-Stealing Malware

The full story

Extracted Entities

Attack Types (2)

Companies (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)