Supply chain attacks hit the PHP ecosystem - here is the composer workflow that reduces your exposure without stopping your deploys.
Laravel-Lang packages compromised via malicious git tags deploy credential-stealing malware executed at PHP autoload time, exfiltrating .env, AWS, SSH, GitHub, and NPM tokens. Supply chain attacks increasingly target PHP ecosystems; demands tighter composer workflows: pre-update audits, rigid version pinning, and minimal dependency surface.
Saturday morning. I opened Twitter and saw a tweet about the Laravel-Lang packages being compromised.
My first reaction was simple: "I don't use that package."
Then I opened composer.json on a project I work on and found this in require-dev:
"laravel-lang/lang": "^14.8",
"laravel-lang/publisher": "^16.8",
Hackers rewrote all Git tags across four Laravel-Lang packages, poisoning over 700 historical versions with backdoors.
A supply chain attack targeting the Laravel Lang localization packages has exposed developers to a sophisticated…
Laravel-Lang compromise tagged 700+ versions on May 22–23, 2026, triggering PHP stealers that exfiltrate credentials.
8 Packagist packages hid malicious package.json scripts, enabling Linux binary execution during installs and workflows.
Versión en español aquí. It's finally Friday! You leave work and go home to work on your...
Every framework has its honeymoon phase. For PHP developers, Laravel has been that reliable,...
