GCVE-110-OSM-2026-316

Composer package `laravel-lang/attributes` was compromised via takeover of the Laravel-Lang GitHub organization. Attackers republished historical version tags across the 12.x-15.x lines (laravel-lang/lang@14.3.7 confirmed by Socket) with a backdoored src/helpers.php that executes during Composer autoload. The backdoor contacts flipboxstudio.info to fetch a second-stage credential harvester targeting cloud credentials, CI/CD tokens, Kubernetes secrets, browser data, password vaults, SSH keys, VPN configs, and environment variables. Malicious payload found in: src/helpers.php Loaded via composer.json autoload.files entry, executing automatically during Composer autoload. Initial backdoor contacts: https://flipboxstudio.info/payload Exfil endpoint: https://flipboxstudio.info/exfil Per-host MD5 marker stored under sys_get_temp_dir()/.laravel_locale/ prevents redundant execution. String obfuscation via character codes; XOR encryption key: k9X2mP7vL4nQ8wR1 Windows second-stage artifact: DebugChromium.exe Second-stage payload queries EC2 IMDS (169.254.169.254) for cloud credentials and steals: - Cloud credentials and CI/CD tokens - Kubernetes secrets - Browser data and password manager vaults - SSH keys and VPN configurations - Environment variables