Laravel-Lang Composer Packages Hit by Tag-Rewriting Supply-Chain Attack

May 22, 2026 · Original article ↗

Summary

Step Security reports four Laravel-Lang Composer packages had all Git tags rewritten to point to malicious commits. A detonation of one package confirmed payload execution and an outbound exfiltration request to flipboxstudio[.]info; three others were not tested.

Key points

On May 22–23, 2026, all existing Git tags across laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/actions, and laravel-lang/attributes were rewritten to point to malicious commits.
The commits add src/helpers.php to Composer’s autoload.files map, causing the payload to run when vendor/autoload.php is loaded.
The payload fetched a second stage from flipboxstudio[.]info, dropped hidden PHP and ELF files under /tmp, made an outbound POST to an exfiltration endpoint, and deleted the dropped files.
Step Security detonated laravel-lang/http-statuses v3.4.5 in an isolated GitHub Actions runner and observed the payload’s process and network activity.
The exfiltration request body was not captured. The other three packages were not detonated; the article says their commits have matching structures and expects similar behavior.
The article advises checking lockfiles and runner activity, treating accessible secrets as compromised if affected packages were installed during the attack window, and rotating those secrets.

Article Details

Attack Vectors: The attacker rewrote existing Git tags in four Laravel-Lang Composer package repositories to point to malicious commits, rather than publishing new versions.
The malicious commits added src/helpers.php to Composer's eager autoload.files map, causing the payload to run when a consuming application required vendor/autoload.php.
The payload fetched a second stage from flipboxstudio.info, launched a hidden PHP loader and an ELF binary in detached processes, and deleted the dropped files.
The loader sent runner environment data to the attacker's C2. The article says the request body was not captured and describes specific harvested secrets as likely, not confirmed.
Defensive Notes: Stop running composer update, and do not run composer install for affected packages without a known-good lockfile.
Inspect composer.lock for the listed imposter commit SHAs and for lockfiles regenerated on or after 2026-05-22 22:32 UTC; treat affected projects as compromised.
If an affected package was installed on or after 2026-05-22 22:32 UTC, treat secrets accessible to that environment as compromised and rotate them.
Check affected runners and developer machines for orphaned PHP or unnamed ELF processes with ppid=1 and the described temporary files.
Search egress and DNS telemetry for flipboxstudio.info and block or sinkhole the domain.
Restore affected tags from verified original commits; audit and revoke organization accounts, applications, and tokens with push access, and enforce 2FA.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`flipboxstudio[.]info`	Attacker C2 domain used to deliver the payload and receive runner environment data.
URL	`hxxps[:]//flipboxstudio[.]info/exfil`	Malicious exfiltration URL receiving data from the compromised runner.
URL	`hxxps[:]//flipboxstudio[.]info/payload`	Malicious stage-one fetch URL used to retrieve the next-stage payload.