Published on:
May 23, 2026
On May 22, 2026, we detected an active supply chain attack against Laravel-Lang. We filed a report with the maintainers immediately. The attacker published malicious version tags across three widely used repositories, injecting credential-stealing code that loads automatically via composer’s autoloader feature.
What makes this particularly sneaky is that the malicious code was never committed to the official repos at all. GitHub allows version tags to point to commits from a fork of the same repository. The attacker exploited this to create tags pointed to commits in a malicious fork they controlled.
233 versions are currently compromised across:
We also reported the attack to Packagist, who responded immediately by taking down the malicious versions and temporarily unlisting the affected packages to prevent further installations.
The attacker introduced a file called src/helpers.php into the affected version tags. On the surface it looks like a routine Laravel localization helper, defining two harmless functions: laravel_lang_locale() and laravel_lang_fallback(). Below those functions, the real work begins.
A self-executing block of code runs once on every machine it infects. It fingerprints the host using a hash of the file path, hostname and inode, then writes a marker file to the system temp directory so it only fires once. The C2 domain is hidden inside an integer array decoded at runtime to evade static scanners. It resolves to flipboxstudio[.]info.
The dropper then fetches a payload from flipboxstudio[.]info/payload using file_get_contents with a curl fallback, both with SSL verification disabled. On Windows it drops a .vbs launcher and runs the payload silently via cscript. On Linux and macOS it executes the payload in the background via exec().
The fetched payload is a ~5,900 line PHP credential stealer, organised into fifteen specialist collector modules. After collecting everything it can find, it encrypts the results with AES-256 and sends them to flipboxstudio[.]info/exfil. It then deletes itself from disk to limit forensic evidence.
Cloud credentials
~/.aws/credentials and live EC2 instance metadata)Infrastructure secrets
/etc/kubernetes/admin.confconfig.json Developer credentials
.git-credentials and .gitconfig files.netrc, .npmrc, .yarnrc, .pypirc, .gem/credentials, .composer/auth.json.env files and config files found by recursively scanning the working directory (wp-config.php, settings.py, docker-compose.yml, secrets.yaml and more)Browsers and password managers
.exe is dropped to decrypt Chrome's DPAPI-protected login databaselogins.json and key4.db across all profiles.kdbx and .kdb database filesCryptocurrency wallets
Windows-specific
.rdp files from Desktop, Documents and DownloadsCommunication platforms
VPN configs
If you are an Aikido user, check your central feed and filter on malware issues. This will surface as a 100/100 critical issue. Aikido rescans nightly, but we recommend triggering a manual rescan now.
If you are not yet an Aikido user, you can create an account and connect your repos. Our malware coverage is included in the free plan, no credit card required.
For broader coverage across your whole team, Aikido's Endpoint Protection gives you visibility and control over the software packages installed on your team's devices. It covers browser extensions, code libraries, IDE plugins, and build dependencies, all in one place. Stop malware before it gets installed.
For future protection, consider Aikido Safe Chain (open source). Safe Chain sits in your existing workflow, intercepting npm, npx, yarn, pnpm, and pnpx commands and checking packages against Aikido Intel before install.
Network
flipboxstudio.info (C2 domain)flipboxstudio.info/payload (dropper fetch)flipboxstudio.info/exfil (exfiltration endpoint)Files and paths
<tmp>/.laravel_locale/<md5_hash> (infection marker)<tmp>/.laravel_locale/<12 random hex chars>.php (dropped stealer)<tmp>/.laravel_locale/<8 random hex chars>.vbs (Windows launcher)Last updated on:
May 23, 2026
4.7/5
Tired of false positives?
Try Aikido like 100k others.
Start Now
Get a personalized walkthrough
Trusted by 100k+ teams
Book Now
Scan your app for IDORs and real attack paths
Trusted by 100k+ teams
Start Scanning
See how AI pentests your app
Trusted by 100k+ teams
Start Testing
May 21, 2026
•
Vulnerabilities & Threats
Deleting a Google API key doesn't revoke it immediately. Our testing found successful authentications up to 23 minutes after deletion, and Google has declined to fix it.
#
AppSec
#
Vulnerabilities
May 20, 2026
•
Vulnerabilities & Threats
A poisoned VS Code extension breached GitHub yesterday, one day after Nx Console (2.2M installs) was compromised for 18 minutes on the Visual Studio Marketplace and reached every user with auto-update on.
#
VS Code
#
Software Supply Chain Security
#
Aikido Endpoint
May 20, 2026
•
Vulnerabilities & Threats
GitHub confirmed a poisoned VS Code extension compromised an employee device, exposing 3,800 internal repos. Why developer workstations are now the top supply chain target.
#
Software Supply Chain Security
Secure your code, cloud, and runtime in one central system.
Find and fix vulnerabilities fast automatically.
No credit card required | Scan results in 32secs.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。