Laravel‑Lang Packages Hijacked via Git Tag Rewrite
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Laravel-Lang's PHP packages (lang, http-statuses, attributes, actions) were compromised when the attacker rewrote every git tag to point to a malicious commit without altering the source code.
- Attacker published more than 700 malicious tags on May 22‑23 2026, many seconds apart, indicating automated mass tagging and likely access to organization‑level credentials or release infrastructure.
- src/helpers.php was added to each package’s autoload.files map, causing the hidden helper to execute automatically on every PHP request as soon as the autoloader runs.
- Flipboxstudio.info serves as the command‑and‑control server that delivers a ~5,900‑line PHP payload, which then fetches a cross‑platform payload for Windows, Linux, and macOS.
- Aikido Security says the payload drops a Visual Basic Script launcher on Windows via cscript and uses exec() on Linux/macOS, harvesting credentials from cloud metadata, CI/CD services, crypto wallets, browsers, password managers, VPNs, and many other sources.
- The stealer encrypts all collected data with AES‑256, sends it to flipboxstudio.info/exfil, and deletes itself to minimize forensic evidence.
Why it matters: Developers and enterprises that rely on Laravel‑Lang’s packages now face wholesale credential theft, while the attackers gain access to cloud tokens, CI/CD credentials, crypto wallets, and personal data, amplifying the breach’s scope across multiple services and can be used to pivot into further system compromises.
