Laravel Lang Supply Chain Attack Spreads Credential-Stealing Malware to Developers

A sophisticated supply chain attack has compromised the Laravel Lang localization packages after attackers rewrote GitHub version tags to distribute credential-stealing malware through Composer. Security researchers from StepSecurity, Aikido Security, and Socket disclosed the campaign on May 23, 2026, warning that developers who installed affected packages may have had cloud credentials, SSH keys, and browser data exfiltrated.

What Happened: Laravel Lang Packages Hijacked in Supply Chain Attack

Attackers compromised four repositories maintained by the Laravel Lang organization. Consequently, they did not modify the original source code directly. Instead, they abused a GitHub feature that allows tags to point to commits in attacker-controlled forks of the same repository.

The affected packages include laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions. Furthermore, Aikido Security reported that 233 versions across three repositories were compromised, while Socket warned that roughly 700 historical versions may have been impacted.

StepSecurity noted that the rewrites began at 22:32 UTC on May 22, 2026, against laravel-lang/lang and finished by 00:00 UTC against laravel-lang/actions. Therefore, all four repositories share the same fake author identity, the same modified files, and the same payload behavior, which makes them almost certainly the work of one actor using one compromised credential with organization-wide push access.

Technical Details of the Laravel Lang Supply Chain Attack

The attack leveraged GitHub tag rewriting to make existing release tags point to malicious commits stored in an attacker-controlled fork. When developers installed the package via Composer, it downloaded the malicious code while appearing to install legitimate Laravel Lang releases.

The malicious releases introduced a file named src/helpers.php, which was automatically loaded by Composer through the autoload section of composer.json. The injected code acted as a dropper that downloaded a second payload from the attacker’s command-and-control server at flipboxstudio[.]info.

Cross-Platform Credential Stealer Payload

The downloaded PHP payload was a large cross-platform credential stealer targeting Linux, macOS, and Windows. It harvests the following:

• Cloud credentials (AWS keys, Google Cloud tokens, Azure credentials)
• Kubernetes secrets and Vault tokens
• Git credentials and CI/CD secrets
• SSH private keys
• Browser data from Chrome, Brave, and Edge
• Cryptocurrency wallet recovery phrases
• Password manager databases
• VPN configurations
• Local .env configuration files

The malware also contains regular expression patterns used to extract AWS keys, GitHub tokens, Slack tokens, Stripe secrets, database credentials, JWTs, SSH private keys, and cryptocurrency recovery phrases from files and environment variables.

Windows-Specific DebugElevator Component

On Windows systems, the PHP payload extracts a base64-encoded executable embedded within the file. This executable is written to the %TEMP% folder as a random .exe filename and then launched. BleepingComputer’s analysis identified the Windows infostealer as DebugElevator, which targets Chrome, Brave, and Edge to extract App-Bound Encryption keys needed to decrypt stored browser credentials.

An embedded PDB path references the Windows account name “Mero” and contains the string “claude,” potentially indicating that AI was used to assist in developing the Windows malware component.

Business and Operational Impact

The Laravel Lang supply chain attack poses significant risks to organizations using the affected packages. Moreover, because Laravel Lang packages are widely adopted localization tools for Laravel applications, the blast radius extends across web development teams globally.

• Credential exposure: Developers may have leaked cloud provider credentials, giving attackers persistent access to production infrastructure.
• CI/CD pipeline compromise: Stolen CI/CD secrets could allow attackers to inject malicious code into automated build and deployment pipelines.
• Source code exposure: Git credentials and SSH keys may grant attackers access to private repositories and intellectual property.
• Browser credential theft: The DebugElevator component enables decryption of stored browser passwords, potentially exposing corporate accounts and single sign-on credentials.
• Cryptocurrency theft: Wallet recovery phrase extraction puts both personal and organizational crypto assets at risk.

Organizations using the affected packages should assume compromise until proven otherwise and rotate all potentially exposed credentials immediately.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Audit installed Laravel Lang package versions and compare them against the known compromised tags.
2. Rotate all cloud credentials, API keys, Git tokens, SSH keys, and database passwords that may have been present on affected systems.
3. Inspect systems for outbound connections to flipboxstudio[.]info and block the domain at the network perimeter.
4. Review CI/CD pipeline logs for unauthorized access or suspicious code injections.
5. Scan for the DebugElevator executable and related indicators of compromise on Windows endpoints.

Long-Term Supply Chain Security Measures

Development teams should implement software composition analysis (SCA) tools to detect compromised dependencies in real time. Furthermore, verifying package checksums and using private package registries with integrity controls can reduce exposure to tag-rewriting attacks. Organizations should also enforce least-privilege access on repository credentials and enable multi-factor authentication for all GitHub organization accounts.

Bottom line: The Laravel Lang supply chain attack demonstrates that attackers can weaponize GitHub tag rewriting to hijack trusted package distributions at scale. Developers must treat every dependency as a potential attack vector and implement robust software supply chain verification.

Incident Summary

CVE ID / Incident:	Laravel Lang Supply Chain Attack (May 2026)
Affected Systems:	laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, laravel-lang/actions (Linux, macOS, Windows)
Disclosure Date:	May 23, 2026
Patch Status:	Packagist removed malicious versions and temporarily unlisted affected packages

References

1. StepSecurity, “Laravel Lang Supply Chain Attack,” May 23, 2026, https://www.stepsecurity.io/blog/laravel-lang-supply-chain-attack, accessed May 23, 2026.
2. Aikido Security, “Supply Chain Attack Targets Laravel Lang Packages with Credential Stealer,” May 23, 2026, https://www.aikido.dev/blog/supply-chain-attack-targets-laravel-lang-packages-with-credential-stealer, accessed May 23, 2026.
3. Socket, “Laravel Lang Compromise,” May 23, 2026, https://socket.dev/blog/laravel-lang-compromise, accessed May 23, 2026.
4. BleepingComputer, “Laravel Lang packages hijacked to deploy credential-stealing malware,” May 23, 2026, https://www.bleepingcomputer.com/news/security/laravel-lang-packages-hijacked-to-deploy-credential-stealing-malware/, accessed May 23, 2026.