Hackers Compromised 233 Versions of Laravel-Lang Packages by Hacking 700 GitHub Repos
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A highly sophisticated supply chain attack has compromised the Laravel-Lang ecosystem, injecting credential-stealing remote code execution backdoors into 233 package versions across 700 GitHub repositories.<\/p>\n
Discovered in May 2026 by Socket and Aikido, threat actors manipulated GitHub tags to distribute malware through Composer\u2019s autoloader, granting complete remote access to developer environments.<\/p>\n
The attackers bypassed direct repository commits by exploiting GitHub\u2019s version tagging system<\/a> to point legitimate tags toward a malicious fork.<\/p>\n When developers pulled the affected localization packages via Packagist, the malicious The initial infection phase utilizes a stealthy dropper that masquerades as a standard Laravel localization function. It fingerprints the host system using specific hardware metrics and establishes a temporary marker file to prevent redundant executions.<\/p>\n Aikido observed<\/a> that the payload disables SSL verification and fetches a secondary script from an obfuscated command-and-control server, launching it silently via OS-specific methods.<\/p>\nsrc\/helpers.php<\/code> executed automatically due to Composer\u2019s autoload.files<\/code> directive. This method effectively hid the malware from standard repository audits while inheriting full web application permissions.<\/p>\nPayload Execution Methods<\/strong><\/h2>\n