Notifications
Clear all
Topic starter
02/08/2026 11:33 am
TL;DR: A supply chain attack against Laravel-Lang compromised 233 package versions and used Composer autoloading to deliver PHP credential-stealing code that harvested cloud tokens, SSH keys, browser passwords, vault files, and .env secrets, according to Aikido. The incident shows how package trust and secrets sprawl can collapse into one failure mode when delivery, execution, and exfiltration are chained together.
NHIMG editorial — based on content published by Aikido: Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer
By the numbers:
- 233 versions are currently compromised across laravel-lang/lang, laravel-lang/attributes, and laravel-lang/http-statuses.
Questions worth separating out
Q: What breaks when a malicious package runs during dependency installation?
A: The main failure is that installation becomes code execution inside a trusted environment.
Q: Why do cloud and NHI secrets make supply chain attacks more dangerous?
A: Because a single stolen token can open access to multiple environments, including cloud consoles, CI systems, and infrastructure tools.
Q: How do security teams know if dependency controls are actually working?
A: Look for whether build systems prevent unauthorised version drift, whether package provenance is checked before install, and whether secret-handling code is isolated from broad application reach.
Practitioner guidance
- Validate package provenance before install Require provenance checks for package tags, forks, and release lineage in Composer workflows so malicious tags cannot masquerade as trusted versions.
- Restrict local credential exposure on developer hosts Move cloud tokens, SSH keys, and CI credentials out of long-lived local files where possible, and reduce the number of secrets reachable from developer workstations.
- Scan for secrets in installed dependencies and runtime behaviour Run dependency and malware analysis in a sandbox that checks for autoload execution, hidden fetches, and access to auth stores, not just source code changes.
What's in the full article
Aikido's full article covers the operational detail this post intentionally leaves for the source:
- The exact malicious package tags, repository paths, and indicators of compromise used in the Laravel-Lang campaign.
- The full 5,900-line credential stealer behaviour, including the collector modules and exfiltration workflow.
- The platform-specific detection guidance and rescan advice that apply to affected repositories and endpoints.
- The malicious domain and file-path markers that help teams hunt for infection in their own environments.
👉 Read Aikido's analysis of the Laravel-Lang supply chain attack and secret theft →
Laravel-Lang supply chain attack: what it means for secrets governance?
Explore further
02/08/2026 12:48 pm
Secrets sprawl has become the real supply chain surface. The Laravel-Lang incident shows that package compromise is no longer only about code integrity. When repositories, build tools, local auth stores, and cloud credentials all intersect, a malicious dependency can become an identity event as much as a malware event. Practitioners should treat secret-bearing environments as part of the trusted software supply chain, not as a separate endpoint problem.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: What should teams do in the first 24 to 72 hours after suspected package compromise?
A: Teams should isolate affected hosts, preserve forensic evidence, rotate exposed credentials, and inspect repositories for unauthorized workflow or package changes. They should also review internal mirrors and caches, because malicious versions may persist there after public removal. The goal is to stop reuse of stolen identities before the attacker expands access.
👉 Read our full editorial: Laravel-Lang package compromise shows how supply chain malware steals secrets
