Malicious Git Tags Poison Four Laravel-Lang Packages With Credential Stealer
Summary
Researchers say attackers poisoned four Laravel-Lang Composer packages with malicious Git tags pointing to a fork. The payload fingerprints systems and downloads a credential stealer; affected users are advised to block the packages and rotate exposed secrets.
Key points
- StepSecurity says malicious tags appeared across three packages on May 22; all four were poisoned by May 23.
- The tags reportedly covered more than 700 historical package versions and pointed to commits in an attacker-controlled fork rather than official repository commits.
- The malicious src/helpers.php file fingerprints systems and connects to flipboxstudio[.]info to retrieve and run a PHP credential stealer.
- The malware targets cloud keys, Kubernetes and Docker configurations, Vault tokens, SSH keys, developer credentials, browser and password-manager data, and other secrets.
- Users and organizations are advised to block the affected packages, verify clean versions, and rotate secrets accessible to systems that installed or ran them.
Article Details
- Event Type
- Software supply-chain attack involving poisoned Laravel-Lang Composer packages.
- Impact
- Malicious version tags across more than 700 historical versions of four packages delivered code that fingerprinted systems and fetched a PHP credential stealer from the reported C2 domain. The malware was designed to harvest cloud credentials, container and Kubernetes configuration, SSH keys, developer credentials, browser and password-manager data, and other sensitive files. Applications that installed or updated the packages may be affected; the article advises treating systems that installed them as potentially compromised and rotating accessible secrets.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | flipboxstudio[.]info | Reported command-and-control domain used to fetch the PHP credential stealer. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware was designed to collect credentials and other sensitive data from local files and system configurations.T1552.001 · Credentials In FilesThe malware was designed to harvest credentials and secrets from files, including SSH private keys and configuration files.T1555.003 · Credentials from Web BrowsersThe malware was designed to target credentials stored in browsers.
Vendors
Products
laravel-lang/actionsThe affected packages, namely laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions, are third-party localization libraries used by Laravel applications.laravel-lang/attributesThe affected packages, namely laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions, are third-party localization libraries used by Laravel applications.laravel-lang/http-statusesThe affected packages, namely laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions, are third-party localization libraries used by Laravel applications.laravel-lang/langThe affected packages, namely laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions, are third-party localization libraries used by Laravel applications.