⚠️ Fake #Laravel packages on #Packagist deploy a cross-platform #RAT on Windows, macOS & Linux — researchers at Socket flagged 3 malicious #PHP packages disguised as Laravel utilities #cybersecurity #supplychain #opensource #infosec
📦 Malicious packages identified:
• nhattuanbl/lara-helper (37 downloads)
• nhattuanbl/simple-queue (29 downloads)
• nhattuanbl/lara-swagger (49 downloads)
🧵 👇
🧩 lara-swagger itself is clean but lists lara-helper as a #Composer dependency — silently pulling in the RAT during installation
🔒 The payload in helper.php uses heavy obfuscation: control flow manipulation, encoded domain names, randomized variable/function identifiers to bypass static analysis
🌐 Once loaded, the RAT connects to C2 server helper.leuleu[.]net:2096, sends system reconnaissance data and awaits commands — full remote access granted to the attacker
💻 Supported RAT commands: ping (heartbeat every 60s), info (system recon), cmd, powershell, run (background shell), screenshot, download, upload, stop
🛡️ Shell execution probes disable_functions and picks first available method from: popen, proc_open, exec, shell_exec, system, passthru — resilient against common #PHP hardening
🔄 C2 connection retries every 15 seconds in a persistent loop — even if C2 is currently offline, the RAT keeps trying
🎭 Threat actor also published 3 clean packages (lara-media, snooze, syslog) to build credibility before deploying malicious ones — classic supply chain deception
💀 Impact: Full remote shell access, arbitrary file read/write, harvesting of .env contents including database credentials & API keys — RAT runs at app boot with same permissions as the web app
✅ If you installed lara-helper or simple-queue: assume compromise, remove packages immediately, rotate ALL secrets, audit outbound traffic to C2 server
https://thehackernews.com/2026/03/fake-laravel-packages-on-packagist.html
michabbb