---
title: Four Laravel-Lang Packages Poisoned in Supply Chain Attack
description: Learn about the Laravel localization package breach affecting AWS, Azure keys, and more. Immediate action required for compromised systems.
canonical_url: https://codekeeper.co/ticker/laravel-localization-supply-chain-attack
---

# Four Laravel-Lang Packages Poisoned in Supply Chain Attack

Learn about the Laravel localization package breach affecting AWS, Azure keys, and more. Immediate action required for compromised systems.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team May 27, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flaravel-localization-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flaravel-localization-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flaravel-localization-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flaravel-localization-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Flaravel-localization-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Flaravel-localization-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Four widely-used Laravel localization packages were compromised in a supply chain attack on May 22 and 23. Someone with push access to the Laravel-Lang GitHub organization — reportedly through a leaked personal access token — rewrote every Git tag across more than 700 historical versions of laravel-lang/lang, http-statuses, attributes, and actions, pointing them at commits in a malicious fork. The payload was a file registered in composer.json's autoload list, so it ran the moment any Laravel or Symfony app booted. It called out to flipboxstudio[.]info and pulled down a PHP credential stealer going after AWS, GCP and Azure keys, SSH keys, Kubernetes configs, browser passwords and crypto wallets, across Windows, Linux, and macOS. CI runners were the prize. Packagist pulled the malicious releases on May 23. Version numbers won't tell you whether you were hit, because the tags themselves were reassigned — a composer.lock pinned to commit hashes before May 22 holds, a version range doesn't. Anything that installed or updated these packages on May 22 or 23 should be treated as compromised: rotate every secret and block the domain. **Source:** [SecurityWeek](https://www.securityweek.com/laravel-lang-packages-poisoned-for-malware-delivery/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flaravel-localization-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flaravel-localization-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flaravel-localization-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flaravel-localization-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Flaravel-localization-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Flaravel-localization-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks ClickFix Attacks Are Getting Sneakier About Hiding Their Payloads Oct 7, 2026](https://codekeeper.co/ticker/clickfix-evolution-evading-detection)

[Massive Supply-Chain Attack Hits 440+ npm Packages in Under Four Hours Aug 11, 2026](https://codekeeper.co/ticker/github-account-hijack-infects-npm-packages)

[Cyberattacks Clop Hackers Strike Again, Targeting PTC Software Used by Major Manufacturers Aug 20, 2026](https://codekeeper.co/ticker/clop-exploits-windchill-zero-day)

[Hackers Use Ghost CMS Flaw to Infect 700+ Websites With ClickFix Malware Aug 12, 2026](https://codekeeper.co/ticker/ghost-cms-vulnerability-exploited-by-hackers)