Related incident · Composer / Packagist supply chain · April–May 2026

laravel-lang and Packagist supply chain attacks (2026): check your composer.lock

Attackers used stolen GitHub access to publish malicious tags for real Packagist packages. In the laravel-lang case the payload ran on every PHP request once installed.

Last updated 2026-10-22

What happened

Packages reported as compromised

Package	When	How it executed	Source
laravel-lang/lang, http-statuses, attributes, actions	22–23 May 2026	Injected `src/helpers.php` in `autoload.files`, so it runs on every request and CLI command	Snyk
intercom/intercom-php 5.0.2	30 April 2026	Turned into a Composer plugin that ran a script on install/update	Socket
Eight packages including devdojo/wave and devdojo/genesis (dev branches)	Reported 23 May 2026	`postinstall` hook in package.json that downloaded a Linux binary	The Hacker News

Packagist says these attacks used taken-over GitHub accounts and stolen tokens to publish new tags on packages the attackers had no legitimate access to, and that the team pulled affected versions within minutes of detection.

Is my application affected?

Check lockfiles and Composer version

# Did a project ever resolve one of the affected packages?
grep -n -E '"name": "(laravel-lang/(lang|http-statuses|attributes|actions)|intercom/intercom-php)"' composer.lock
composer show --locked | grep -E 'laravel-lang|intercom'
composer --version          # 2.10+ adds dependency policies for malware-flagged versions
composer audit

How to fix it

If an affected version was installed anywhere (laptops, CI, containers, servers), isolate it, keep evidence, and rebuild from a clean image.
Rotate every secret the PHP process or CI job could read: .env values, cloud keys, database passwords, deploy tokens, SSH keys.
Upgrade to Composer 2.10 or later and commit composer.lock so builds do not silently resolve new tags.

FAQ

How do I know if my app pulled a malicious version?

Search composer.lock in every branch and every built image for the package names on this page, and compare the install date with the attack window. A lockfile resolved before the malicious tags appeared would have kept the old commit reference.

Is composer update enough?

No. Updating replaces the package, but the laravel-lang payload ran a credential stealer. Treat the machine or container as compromised and rotate cloud keys, database passwords, CI tokens and SSH keys it could access.

What did Packagist change?

Packagist’s 27 May 2026 post describes malware flags from Aikido shown in metadata, stable version immutability so tags cannot be silently rewritten, and Composer 2.10 dependency policies that cover malware-flagged versions.

Sources

Outbound links leave this site. We do not host exploit code.

An update on Composer & Packagist supply chain security (27 May 2026) — Packagist blog
Laravel Lang supply chain advisory — Snyk
Mini Shai-Hulud spreads to Packagist: malicious Intercom PHP package — Socket
Packagist supply chain attack infects 8 packages using GitHub-hosted Linux malware (23 May 2026) — The Hacker News