Four Laravel-Lang Packages Poisoned in Supply Chain Attack

Learn about the Laravel localization package breach affecting AWS, Azure keys, and more. Immediate action required for compromised systems.

By Content Team

May 27, 2026

ON THIS PAGE

Four widely-used Laravel localization packages were compromised in a supply chain attack on May 22 and 23. Someone with push access to the Laravel-Lang GitHub organization — reportedly through a leaked personal access token — rewrote every Git tag across more than 700 historical versions of laravel-lang/lang, http-statuses, attributes, and actions, pointing them at commits in a malicious fork.

The payload was a file registered in composer.json's autoload list, so it ran the moment any Laravel or Symfony app booted. It called out to flipboxstudio[.]info and pulled down a PHP credential stealer going after AWS, GCP and Azure keys, SSH keys, Kubernetes configs, browser passwords and crypto wallets, across Windows, Linux, and macOS. CI runners were the prize.

Packagist pulled the malicious releases on May 23. Version numbers won't tell you whether you were hit, because the tags themselves were reassigned — a composer.lock pinned to commit hashes before May 22 holds, a version range doesn't. Anything that installed or updated these packages on May 22 or 23 should be treated as compromised: rotate every secret and block the domain.

Source: SecurityWeek

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?