Malware Found in Laravel-Lang Composer Packages After Git Tag Poisoning Attack

A recent security incident has compromised four Laravel-Lang Composer packages, including laravel-lang/lang, http-statuses, attributes, and actions, by rewriting over 700 Git tags tied to historical versions, thereby injecting malware into these libraries¹. The attackers targeted the community-driven Laravel-Lang project, which provides translation and localization files for Laravel applications. This Git tag poisoning attack puts numerous Laravel apps at risk, as the affected packages are widely used for localization. The incident highlights the vulnerability of open-source projects to such attacks, where attackers can manipulate Git tags to inject malicious code into popular libraries. This type of attack can have severe consequences, including data breaches and unauthorized access to sensitive information, so practitioners should be vigilant about monitoring their dependencies and updating their packages to ensure the security of their applications.