Hackers Compromise Laravel-Lang Packages via 700 GitHub Repos

A supply-chain attack detected on May 22–23, 2026 compromised over 700 historical versions of four Laravel-Lang PHP localization packages by creating release tags pointing to commits in attacker-controlled forks. The malicious autoloaded src/helpers.php dropper provides RCE, contacts flipboxstudio.info to retrieve a large cross-platform credential-stealing payload that harvests cloud and developer secrets, browser passwords, and cryptocurrency wallets, exfiltrates encrypted data, and self-deletes; Packagist removed the tainted versions and users should treat impacted hosts as fully compromised and rotate/rebuild affected assets.