Product
laravel-lang/http-statuses
- First Reported
- May 22, 2026
- Latest Reported
- May 25, 2026
Reported Context (2)
- The affected packages, namely laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions, are third-party localization libraries used by Laravel applications. Malicious Git Tags Poison Four Laravel-Lang Packages With Credential Stealer
- We confirmed end to end exploitation by detonating laravel-lang/http-statuses v3.4.5 in an isolated GitHub Actions runner protected by Harden-Runner in audit mode. The other three packages share identical commit Laravel-Lang Composer Packages Hit by Tag-Rewriting Supply-Chain Attack
MITRE ATT&CK (9)
Vendors (1)
Products (4)
Tools (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.