Four Laravel-Lang Packages Poisoned in Supply Chain Attack

Learn about the Laravel localization package breach affecting AWS, Azure keys, and more. Immediate action required for compromised systems.

By Content Team

May 27, 2026

ON THIS PAGE

Four widely-used Laravel localization packages were compromised in a supply chain attack starting May 22. Hackers rewrote Git tags across over 700 historical versions of laravel-lang/lang, http-statuses, attributes, and actions — without ever touching the official repos. Instead, they pointed tags to commits in a malicious fork they controlled.

The malware connected to a C&C server to deploy a PHP credential stealer targeting AWS, GCP, Azure keys, SSH private keys, Kubernetes tokens, browser passwords, crypto wallets, and more — across Windows, Linux, and macOS.

Any system that installed or updated these packages should be treated as compromised, and all secrets rotated immediately.

Source: SecurityWeek

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?