- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,696
A large-scale attack affected more than 700 versions, and the defense did not even work.
Popular Laravel-Lang packages were drawn into a major supply chain attack: the attacker did not add malicious code to the main repositories, but replaced historical release tags. Because of this technique, the infected version could look like a regular update and was launched automatically when the application was operated.
According to Aikido, Step Security and SnykSnyk, the attack began on May 22, 2026 and affected the Laravel-angang/lang, laravel-lang/http-statuses, laravel-lang/cates, laravel-lang/cats and laravel-lang/cats published through Packagist. These libraries use in Laravel projects for translations, validation messages, and HTTP status descriptions. Snyk estimates the scale of infection in more than 700 historical versions, although the first reports said about 233 malicious releases.
The attacker took advantage of the feature of the bundle of GitHub and Packagist: the tags could indicate the terms from the attack-controlled fork, and not the code from the official repository. In the substituted versions, the src/helpers.php file was added and prescribed it in Composer via autoload.filles. Such a file is loaded immediately when you connect vendor/autoload.php, so the malicious code was triggered without calling a separate function.
The first component communicated with the flipboxstudio domain, downloaded the second component and ran it in the background. Further, the malware collected secrets from the environment, CI/CD, cloud profiles AWS, GCP and Azure, Kubernetes, Vault, SSH keys, .env files, browsers, password managers, crypto wallets and Slack, Discord and Telegram. After sending data to the server of the attacker, the program tried to remove the traces from the disk.
Packagist removed the malicious versions and temporarily hid the affected packages. Projects that installed Laravel-Lang after May 22, 2026, need to check the composer.lock, traces src/helpers.php in the vendor/laravel-lang, network accesses to flipboxstudio[.]info and the temporary .laravel_locale temporary directory.
When installed confirmed, the infected version is safer to consider all the secrets available to the PHP process and urgently replace keys, tokens and passwords urgently.
Popular Laravel-Lang packages were drawn into a major supply chain attack: the attacker did not add malicious code to the main repositories, but replaced historical release tags. Because of this technique, the infected version could look like a regular update and was launched automatically when the application was operated.
According to Aikido, Step Security and SnykSnyk, the attack began on May 22, 2026 and affected the Laravel-angang/lang, laravel-lang/http-statuses, laravel-lang/cates, laravel-lang/cats and laravel-lang/cats published through Packagist. These libraries use in Laravel projects for translations, validation messages, and HTTP status descriptions. Snyk estimates the scale of infection in more than 700 historical versions, although the first reports said about 233 malicious releases.
The attacker took advantage of the feature of the bundle of GitHub and Packagist: the tags could indicate the terms from the attack-controlled fork, and not the code from the official repository. In the substituted versions, the src/helpers.php file was added and prescribed it in Composer via autoload.filles. Such a file is loaded immediately when you connect vendor/autoload.php, so the malicious code was triggered without calling a separate function.
The first component communicated with the flipboxstudio domain, downloaded the second component and ran it in the background. Further, the malware collected secrets from the environment, CI/CD, cloud profiles AWS, GCP and Azure, Kubernetes, Vault, SSH keys, .env files, browsers, password managers, crypto wallets and Slack, Discord and Telegram. After sending data to the server of the attacker, the program tried to remove the traces from the disk.
Packagist removed the malicious versions and temporarily hid the affected packages. Projects that installed Laravel-Lang after May 22, 2026, need to check the composer.lock, traces src/helpers.php in the vendor/laravel-lang, network accesses to flipboxstudio[.]info and the temporary .laravel_locale temporary directory.
When installed confirmed, the infected version is safer to consider all the secrets available to the PHP process and urgently replace keys, tokens and passwords urgently.
