high severityConfidence highHistorical record

Laravel Lang package compromise

Direct answer

Laravel Lang package compromise, also tracked as Laravel Lang compromise is a high-severity threat campaign HOL Guard tracked from May 22, 2026 to May 23, 2026, verified against 11 primary sources and last reviewed Sep 3, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

Socket documented a compromise of third-party Laravel Lang packages in which malicious code was introduced across many historical versions and could execute through Composer autoload behavior during normal application runtime.

Also tracked as Laravel Lang compromise

First observed
May 22, 2026
Last observed
May 23, 2026
Last reviewed
Sep 3, 2026
Tracking ended
Sep 8, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

The reviewed HOL Guard v3.0.18 release and tagged support matrix still label Packagist/Composer as Beta support, establishing partial coverage for eligible observed package actions rather than universal Composer runtime mediation. The v3.0.18 tag pyproject declares project version 3.0.1, so it is retained only as evidence of a metadata inconsistency and is not used as release-version proof.

  • Composer support is Beta and partial. Lockfile review, registry advisories, secret rotation, and endpoint incident response remain necessary because Guard cannot retroactively remediate code that already executed through Composer autoload.
  • The v3.0.18 tag pyproject declares project version 3.0.1; release-version provenance for this review therefore comes from the official v3.0.18 release record and matching release assets, not that pyproject version field.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • partial

    The reviewed HOL Guard v3.0.18 support matrix labels Packagist/Composer Beta, so eligible Composer package actions can receive Guard supply-chain review. The reported malicious code executes through Composer autoload during application runtime; Guard does not claim universal mediation of that runtime path or retroactive remediation after execution.

  • Recipe available

    Require review or explicit approval for new or changed dependency installation before an eligible package-manager action executes.

    Coverage depends on the active Guard release, package manager, harness event surface, and local policy. It is not a guarantee that every dependency path is intercepted.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. First observed

    Laravel Lang package compromise was first observed in the reviewed source material.

    Source:Socket: Laravel Lang compromise

  2. Disclosure

    The reviewed source published or updated its defensive analysis and remediation guidance.

    Source:Socket: Laravel Lang compromise

  3. Correction

    Coverage corrected from not_covered to partial after stable HOL Guard 2.0.1112 was reverified to label Packagist/Composer Beta; runtime/autoload execution remains outside a universal protection claim.

    Sources:Socket: Laravel Lang compromise·HOL Guard 2.0.1112: Composer support matrix

  4. Correction

    Coverage evidence corrected to current stable HOL Guard 2.2.5 after PyPI release metadata showed 2.0.1112 was no longer the stable release; v2.2.5 still labels Packagist/Composer Beta, so the partial relationship is unchanged.

    Sources:Socket: Laravel Lang compromise·PyPI: HOL Guard stable release metadata at 2026-08-21·HOL Guard v2.2.5: Composer support matrix

  5. Correction

    Coverage evidence refreshed after the previously current 2.2.5 reference became obsolete; the reviewed HOL Guard v2.2.122 stable-line support matrix still labels Packagist/Composer Beta, so the partial relationship remains unchanged.

    Sources:Socket: Laravel Lang compromise·HOL Guard v2.2.122: stable-line project metadata·HOL Guard v2.2.122: Composer support matrix

  6. Correction

    Coverage evidence refreshed after HOL Guard v3.0.0 became the reviewed stable release; its support matrix still labels Packagist/Composer Beta, so the partial relationship and runtime/autoload limitation remain unchanged.

    Sources:Socket: Laravel Lang compromise·HOL Guard v3.0.0: stable project metadata·HOL Guard v3.0.0: Composer support matrix

  7. Correction

    Coverage evidence refreshed to the official v3.0.18 release. Composer remains Beta and Laravel remains partial coverage; the tagged pyproject version mismatch is recorded as inconsistent provenance rather than used as release-version evidence.

    Sources:Socket: Laravel Lang compromise·HOL Guard v3.0.18: official release·HOL Guard v3.0.18 tag: inconsistent project metadata·HOL Guard v3.0.18: Composer support matrix

Publication clock: 1883.5 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; historical backfill outside target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • laravel-lang affected packagesComposerpackage

Sources

Every claim on this record is traceable to the sources below.

Campaign questions, answered

Socket documented a compromise of third-party Laravel Lang packages in which malicious code was introduced across many historical versions and could execute through Composer autoload behavior during normal application runtime. HOL Guard tracked the campaign from May 22, 2026 to May 23, 2026.

No. Active tracking ended Sep 8, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 11 primary sources, names 1 reviewed artifact, and was last fully reviewed Sep 3, 2026 by HOL Guard Research. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage. The campaign-specific policy starting point is linked from the coverage section of this record.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. The reviewed HOL Guard v3.0.18 release and tagged support matrix still label Packagist/Composer as Beta support, establishing partial coverage for eligible observed package actions rather than universal Composer runtime mediation.

Reviewed in full by HOL Guard Research.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-LARAVELANG