Published on:
May 23, 2026
On May 22, 2026, we detected an active supply chain attack against Laravel-Lang. We filed a report with the maintainers immediately. The attacker published malicious version tags across three widely used repositories, injecting credential-stealing code that loads automatically via composer’s autoloader feature.
What makes this particularly sneaky is that the malicious code was never committed to the official repos at all. GitHub allows version tags to point to commits from a fork of the same repository. The attacker exploited this to create tags pointed to commits in a malicious fork they controlled.
233 versions are currently compromised across:
We also reported the attack to Packagist, who responded immediately by taking down the malicious versions and temporarily unlisting the affected packages to prevent further installations.
The attacker introduced a file called src/helpers.php into the affected version tags. On the surface it looks like a routine Laravel localization helper, defining two harmless functions: laravel_lang_locale() and laravel_lang_fallback(). Below those functions, the real work begins.
A self-executing block of code runs once on every machine it infects. It fingerprints the host using a hash of the file path, hostname and inode, then writes a marker file to the system temp directory so it only fires once. The C2 domain is hidden inside an integer array decoded at runtime to evade static scanners. It resolves to flipboxstudio[.]info.
The dropper then fetches a payload from flipboxstudio[.]info/payload using file_get_contents with a curl fallback, both with SSL verification disabled. On Windows it drops a .vbs launcher and runs the payload silently via cscript. On Linux and macOS it executes the payload in the background via exec().
The fetched payload is a ~5,900 line PHP credential stealer, organised into fifteen specialist collector modules. After collecting everything it can find, it encrypts the results with AES-256 and sends them to flipboxstudio[.]info/exfil. It then deletes itself from disk to limit forensic evidence.
Cloud credentials
~/.aws/credentials and live EC2 instance metadata)Infrastructure secrets
/etc/kubernetes/admin.confconfig.json Developer credentials
.git-credentials and .gitconfig files.netrc, .npmrc, .yarnrc, .pypirc, .gem/credentials, .composer/auth.json.env files and config files found by recursively scanning the working directory (wp-config.php, settings.py, docker-compose.yml, secrets.yaml and more)Browsers and password managers
.exe is dropped to decrypt Chrome's DPAPI-protected login databaselogins.json and key4.db across all profiles.kdbx and .kdb database filesCryptocurrency wallets
Windows-specific
.rdp files from Desktop, Documents and DownloadsCommunication platforms
VPN configs
If you are an Aikido user, check your central feed and filter on malware issues. This will surface as a 100/100 critical issue. Aikido rescans nightly, but we recommend triggering a manual rescan now.
If you are not yet an Aikido user, you can create an account and connect your repos. Our malware coverage is included in the free plan, no credit card required.
For broader coverage across your whole team, Aikido's Endpoint Protection gives you visibility and control over the software packages installed on your team's devices. It covers browser extensions, code libraries, IDE plugins, and build dependencies, all in one place. Stop malware before it gets installed.
For future protection, consider Aikido Safe Chain (open source). Safe Chain sits in your existing workflow, intercepting npm, npx, yarn, pnpm, and pnpx commands and checking packages against Aikido Intel before install.
Network
flipboxstudio.info (C2 domain)flipboxstudio.info/payload (dropper fetch)flipboxstudio.info/exfil (exfiltration endpoint)Files and paths
<tmp>/.laravel_locale/<md5_hash> (infection marker)<tmp>/.laravel_locale/<12 random hex chars>.php (dropped stealer)<tmp>/.laravel_locale/<8 random hex chars>.vbs (Windows launcher)Last updated on:
Jun 3, 2026
Tired of false positives?
Try Aikido like 100k others.
Start Now
Get a personalized walkthrough
Trusted by 100k+ teams
Book Now
Scan your app for IDORs and real attack paths
Trusted by 100k+ teams
Start Scanning
See how AI pentests your app
Trusted by 100k+ teams
Start Testing
•
Vulnerabilities & Threats
The compromised onering Rust crate v1.4.1 on crates.io shipped a malicious build.rs that exfiltrates the diff of your latest commit to a hosted Sentry endpoint every time you build.
•
Vulnerabilities & Threats
Aikido Security discovered a critical unauthenticated authentication bypass in phpBB affecting tens of millions of users. A single HTTP request is all it takes to take over any account — a vulnerability that's been sitting in the codebase since 2014.
•
Vulnerabilities & Threats
Deep dive into binding.gyp, the often overlooked npm build file that can execute malicious code at install time through shell expansions, sandbox escapes, and compiler hijacking.
Secure your code, cloud, and runtime in one central system.
Find and fix vulnerabilities fast automatically.
No credit card required | Scan results in 32secs.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。