Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer
Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer
https://thehackernews.com/2026/05/laravel-lang-php-packages-compromised.html
Publish Date: 2026-05-23 05:51:00
Source Domain: thehackernews.com
Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework.
The affected packages include –
- laravel-lang/lang
- laravel-lang/http-statuses
- laravel-lang/attributes
- laravel-lang/actions
“The timing and pattern of the newly published tags point to a broader compromise of the Laravel Lang organization’s release process, rather than a single malicious package version,” Socket said. “The tags were published in rapid succession on May 22 and May 23, 2026, with many versions appearing only seconds apart.”
More than 700 versions associated with these packages have been identified, indicating automated mass tagging or republishing. It’s suspected that the attacker may have managed to obtain access to organization-level credentials, repository automation, or release infrastructure.
The core malicious functionality is located in a file named “src/helpers.php” that’s embedded into the version tags. It’s mainly designed to fingerprint the infected host and contact an external server (“flipboxstudio[.]info”) to retrieve a PHP-based cross-platform payload that runs on Windows, Linux, and macOS.
“The attacker added src/helpers.php to the autoload.files map in each compromised package,” StepSecurity said. “Because every Laravel application calls require __DIR__.’/vendor/autoload.php’ on startup, and because Symfony, PHPUnit, and most other PHP frameworks do the same, the payload runs the moment any consumer of the package boots. No class instantiation, no method call, no special trigger is required.”
According to Aikido Security, the dropper delivers a Visual Basic Script launcher on Windows and runs it via cscript. On Linux and macOS, it executes the stealer payload via exec().
“Because this file [‘src/helpers.php’] is registered in the composer.json…
