Historical Packagist Tags Became a Provenance Trap
The break is not just that a Composer package was malicious. It is that Packagist’s tag-to-GitHub resolution let attackers republish old laravel-lang releases after the fact, so a version number no longer proves the package came from the original source. That makes normal trust checks on historical tags unreliable, even when the release looks old and legitimate.
Researchers saw 700+ laravel-lang tags mass-republished on May 22–23 across laravel-lang/lang, http-statuses, attributes, and actions. The poisoned releases carried an autoloaded helpers.php that contacted flipboxstudio[.]info and dropped a cross-platform credential stealer, exposing cloud, CI/CD, SSH, Vault, browser, password manager, and wallet secrets in Composer-based builds and requests.
The risk persists after the repo looks clean. Any environment that installed one of the poisoned releases may have already executed the backdoor at install or request time, and the stolen secrets can outlive the package compromise itself.