TLDR Tech / InfoSec
Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer
An attacker compromised 233 versions across three Laravel-Lang repositories, including laravel-lang/lang (7.8k stars), by abusing GitHub's version-tagging system to point tags at commits in an attacker-controlled fork, allowing malicious code to load via Composer's autoloader without touching the official repos. The injected src/helpers.php dropper fingerprints the host, decodes the C2 domain flipboxstudio[.]info from an integer array, and fetches a ~5,900-line PHP stealer that harvests cloud and infrastructure credentials, SSH keys, browser and password-manager vaults, crypto wallets, and communication-platform tokens. It then encrypts the exfiltrated data with AES-256 and deletes itself. Defenders should audit Composer dependencies for the affected versions, block flipboxstudio[.]info, hunt for a marker and dropped .php/.vbs artifacts, and rotate any credentials exposed on affected hosts.
Read the full story