composer | byteiota

Tag: composer

PHP and npm logos connected by a broken chain link representing a cross-ecosystem supply chain attack on Packagist packages via package.json postinstall hooks

News

Packagist Attack Hid Malware in package.json — 8 PHP Packages Hit

Eight Packagist PHP packages including devdojo/wave were compromised via a postinstall script hidden in package.json. ...

May 24, 2026

Broken chain links with PHP code fragments and red warning indicators representing the Laravel-Lang supply chain attack

News

Laravel-Lang Supply Chain Attack: 700 Repos Poisoned — Rotate Now

A supply chain attack rewrote 233 Laravel-Lang Composer package versions via Git tag manipulation. If ...

May 24, 2026