Laravel-Lang PHP Packages Compromised in Supply Chain Attack

Cybersecurity researchers identified a software supply chain attack targeting multiple PHP packages within the Laravel-Lang ecosystem to deploy a cross-platform credential-stealing framework. The compromised packages include laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions. The attack involved malicious updates to these packages, though no specific dates or CVE IDs were disclosed. The malware is designed to harvest credentials across affected systems, though the exact scope of impacted users or organizations remains unconfirmed. No additional technical details about the credential-stealing mechanism were provided in the report.