Laravel-Lang Supply Chain Attack Poisons 233 Versions Across 700 Repos With RCE Backdoor

Four widely-used Laravel localization packages were compromised in an active supply chain attack discovered on May 22–23, 2026 by researchers at Aikido Security and the Socket Research Team. The affected packages — laravel-lang/lang (7.8k GitHub stars), laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions — had 233 malicious version tags injected across the 12.x through 15.x release lines.

The attack vector is subtle and targets a Composer/GitHub edge case. The attacker created a malicious fork of the official repositories, then pushed release tags from the legitimate repos that pointed to commits inside the attacker-controlled fork. To a developer scanning the tag list or watching release events, everything looked normal. Once Composer resolved a poisoned tag, the malicious code loaded automatically through the autoloader — no additional user action required.

What the payload does

The injected code is a ~5,900-line PHP credential stealer organized into fifteen specialist collector modules. On execution it harvests:

• Cloud access keys for AWS, GCP, Azure, and DigitalOcean
• Kubernetes configuration files and Docker authentication tokens
• SSH private keys and Git credentials
• Any secrets stored in Laravel .env files

All collected data is silently exfiltrated to an attacker-controlled server over HTTPS.

Who is affected

Any PHP application that ran composer install or composer update and pulled one of the 233 compromised version hashes. The attack was live long enough that CI/CD pipelines with automated dependency updates are the highest-risk targets. Packagist took down the malicious versions and temporarily unlisted all four packages once notified, halting new installations.

What to do right now

Check your composer.lock for any of these packages. If you find one, treat the host as fully compromised:

1. Rotate every secret the system had access to — AWS IAM keys, GCP service accounts, SSH keys, database passwords, API tokens
2. Audit cloud provider access logs for unusual API calls in the past 72 hours
3. Upgrade to the clean versions published after the incident or pin to a verified commit hash
4. Run composer audit and enable Socket or similar SCA tooling in your CI pipeline

The Laravel-Lang attack follows a familiar pattern established by the node-ipc and TanStack npm incidents earlier this month. The Composer ecosystem has historically had fewer automated safety checks than npm, making it an increasingly attractive target. The pace of PHP supply chain attacks is accelerating.

Packagist has pledged to enforce stricter validation on version tag ownership to prevent the fork-redirect technique used here. That work is ongoing.