Researchers report a software supply chain attack that compromises several Laravel-Lang PHP localization packages and uses them to deliver credential-stealing malware. According to multiple outlets, attackers abused GitHub version tags to publish malicious code, which then flowed into Composer package updates. The malware is described as a cross-platform credential stealer, designed to collect sensitive information from affected systems.
The compromised packages discussed include laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions. The reporting notes that the attackers’ activity centers on newly published tags, suggesting the malicious releases are tied to specific version markings rather than the underlying repositories alone. Once developers install or update these packages via Composer, the malicious components are delivered as part of the normal dependency workflow.
The outlets collectively emphasize the supply chain nature of the incident—where legitimate package management mechanisms are used to distribute harmful payloads—and advise that users review affected package versions and apply mitigations such as removing compromised releases and updating to safe versions when available.
