Laravel Lang Supply Chain Advisory

In May 2026, a supply chain attack targeted the Laravel community by republishing malicious versions of four popular localization libraries under the laravel-lang namespace on Packagist. The attacker exploited a vulnerability in the GitHub-to-Packagist publishing flow to point Git tags to an attacker-controlled fork, rather than the official repositories. The malicious code included a script that executed upon installation, downloading a second-stage credential stealer that compromised cloud keys, Kubernetes and Vault secrets, CI/CD tokens, and other sensitive data. Over 700 historical versions were affected, prompting Packagist to unlist the compromised packages while remediation efforts are underway. The incident highlights the importance of verifying package integrity and controlling egress in development environments to prevent similar attacks. Snyk has flagged the affected versions and continues to monitor the situation, advising users to rotate credentials and quarantine impacted hosts. The Laravel core team was not involved with these community-maintained packages, underscoring the need for stringent security measures in handling dependencies.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.