Supply Chain Compromise Affecting Laravel Lang Ecosystem

Laravel Lang is an open-source project offering localization and internationalization packages for Laravel applications, distributed via Packagist, the official Composer package registry for PHP. On May 23, 2026, a supply chain compromise affecting the Laravel-Lang GitHub organization was discovered by the Socket and Aikido teams. Malicious actors manipulated the GitHub tagging system to point legitimate release tags to a malicious fork, introducing a backdoor enabling remote code execution (RCE) into over 700 versions of the laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions packages. Compromised versions include a malicious file named src/helpers.php, automatically executed via the autoload.files entry in the composer.json file. The malicious code acts as a cross-platform stealer allowing the exfiltration of sensitive data present on affected systems. The malware targets in particular .env files, SSH keys, CI/CD tokens, cloud identifiers (AWS, Azure, GCP), Kubernetes tokens, GitHub/GitLab/Bitbucket identifiers, as well as various information stored on development workstations and server environments. This compromise would allow a malicious actor to execute arbitrary code remotely and exfiltrate sensitive data from systems using compromised versions of Laravel Lang packages.

• The Composer packages laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes and laravel-lang/actions in their compromised versions;
• Any system (developer workstation, CI/CD server, production environment) having executed composer install or composer update integrating one of the affected versions is considered compromised.;