Read, Watch or Listen

United States-based security researchers reported that four popular Laravel-Lang Composer packages were surreptitiously poisoned with malware after attackers manipulated Git tags to redirect users to malicious code, according to a SecurityWeek article published Monday. The affected PHP localization libraries are laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions, which are widely used by Laravel applications. Investigators from StepSecurity, Socket, and Aikido Security said the attack began on May 22, when attackers rewrote version tags across hundreds of historical releases to point to attacker-controlled commits in a fork, without altering the official GitHub repositories. By 00:00 UTC on May 23, all four packages had been poisoned, meaning both new installations and routine updates could have pulled in the compromised versions. United States security analysts said the malicious tags introduced a file named src/helpers.php that posed as a normal Laravel localization helper, but instead fingerprinted systems and contacted the command-and-control domain flipboxstudio[.]info to download and run a PHP-based credential stealer. Researchers reported that the malware targeted a wide range of secrets and configuration data on Windows, Linux, and macOS systems, including cloud keys for Amazon Web Services, Google Cloud Platform, and Microsoft Azure, as well as Docker and Kubernetes configurations, HashiCorp Vault tokens, SSH private keys, browser-stored credentials, password manager data, cryptocurrency wallets, communication tools, VPN configurations, CI/CD secrets, .env files, and other sensitive local application files. Security experts advised organizations and individual users to block the affected packages, treat any systems that installed the compromised versions as potentially breached, and rotate exposed credentials and tokens across cloud infrastructure, development environments, and source-control platforms.

By Sarah Whitman | JQJO News