On May 22, 2026, an attacker with push access to the Laravel-Lang GitHub organization executed a sophisticated supply chain attack by rewriting every git tag across multiple popular Composer packages within 15 minutes. The attack targeted laravel-lang/http-statuses, laravel-lang/actions, and laravel-lang/attributes packages. Anyone running composer update or installing fresh packages now pulls malicious payload that exfiltrates CI secrets to a typosquatted attacker domain. StepSecurity confirmed end-to-end exploitation and filed security issues in all affected repositories.