On May 22, 2026, attackers carried out a supply chain attack against three popular Laravel-Lang Composer packages (laravel-lang/lang, laravel-lang/attributes, and laravel-lang/http-statuses) by abusing GitHub's tag system to point 233 version tags at commits in malicious forks rather than the legitimate repos. The injected src/helpers.php dropper auto-loaded via Composer, fingerprinted the host, and pulled down a ~5,900-line PHP credential stealer that harvested cloud credentials (AWS/GCP/Azure), SSH keys, browser passwords, crypto wallets, VPN configs, and chat tokens before encrypting, exfiltrating, and self-destructing. Packagist removed the malicious versions and temporarily delisted the