Hackers Compromised 233 Versions of Laravel-Lang Packages by Hacking 700 GitHub Repos

A sophisticated supply-chain attack discovered in May 2026 compromised the Laravel-Lang ecosystem by manipulating Git tags to distribute Composer-autoloaded PHP backdoors across 233 package versions in ~700 GitHub repositories; the dropper fingerprints hosts, disables SSL verification, fetches a secondary PHP credential stealer with 15 collection modules, encrypts harvested secrets with AES‑256 and exfiltrates them to flipboxstudio.info before cleaning traces. The report provides OS-specific execution details, IOCs (domains, URLs, file paths, an artifact and metadata), and recommends rotating exposed credentials, auditing composer.lock files, monitoring outbound traffic, and rebuilding affected systems from known-good images.