Security: All repository tags have been rewritten to point to malicious commits · Issue #277 · Laravel-Lang/http-statuses · GitHub
//voltron/issues_fragments/issue_layout" data-turbo-transient="true" />
Skip to content
Search or jump to...
Search code, repositories, users, issues, pull requests...
-->
Search
Clear
Search syntax tips
Provide feedback
--><br>We read every piece of feedback, and take your input very seriously.
Include my email address so I can be contacted
Cancel
Submit feedback
Saved searches
Use saved searches to filter your results more quickly
-->
Name
Query
To see all available qualifiers, see our documentation.
Cancel
Create saved search
Sign in
//voltron/issues_fragments/issue_layout;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up
Appearance settings
Resetting focus
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
Laravel-Lang
http-statuses
Public
Uh oh!
There was an error while loading. Please reload this page.
Notifications<br>You must be signed in to change notification settings
Fork<br>25
Star<br>28
Security: All repository tags have been rewritten to point to malicious commits #277
New issue<br>Copy link
New issue<br>Copy link
Open
Open<br>Security: All repository tags have been rewritten to point to malicious commits#277
Copy link
Description
varunsh-coder<br>opened on May 23, 2026
Issue body actions
Summary
All tags in this repository have been rewritten to point to malicious commits. Anyone running composer require laravel-lang/http-statuses or composer update against any version constraint will pull a payload that exfiltrates CI/CD secrets to an attacker-controlled domain.
This is part of a coordinated campaign that also affected Laravel-Lang/http-statuses, Laravel-Lang/actions, and Laravel-Lang/attributes within a ~15 minute window on 2026-05-22.
Quick indicators
C2 domain: flipboxstudio.info
Compromised commits author: Your Name
Files modified in every malicious commit: composer.json and src/helpers.php
Rewrite window: 2026-05-22 between 23:41 UTC and 23:56 UTC
Full details
For the complete analysis (kill chain, full IOC list, recovery steps for users and maintainers, evidence from a detonation in an instrumented runner), see the StepSecurity write-up which we will keep updated as we learn more:
https://www.stepsecurity.io/blog/laravel-lang-supply-chain-attack
— StepSecurity Threat Intelligence team
Reactions are currently unavailable
Metadata<br>Metadata<br>Assignees
No one assigned
Labels
No labelsNo labels
Type
No type
Fields<br>Give feedback
No fields configured for issues without a type.
Projects
No projects
Milestone
No milestone
Relationships
None yet
Development
No branches or pull requests
Issue actions
You can’t perform that action at this time.